[Git][security-tracker-team/security-tracker][master] NFUs

Sun Nov 1 19:59:15 GMT 2026


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f3ea51f7 by Moritz Muehlenhoff at 2026-11-01T20:58:50+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1628,7 +1628,7 @@ CVE-2026-15466 (Software installed and run as a non-privileged user may conduct
 CVE-2026-13303 (HashiCorp Boundary and Boundary Enterprise are vulnerable to a server- ...)
 	NOT-FOR-US: Hashicorp products not packaged in Debian
 CVE-2026-119325 (Bricks Theme 2.4 and before for WordPress contains an unauthenticated  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-119317 (On Linux, an authenticated, low-privileged Nessus user with scan-creat ...)
 	TODO: check
 CVE-2026-119286 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
@@ -1644,7 +1644,7 @@ CVE-2026-119283 (joserfc is a Python library that provides an implementation of
 	NOTE: https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76
 	NOTE: Fixed by: https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17 (1.7.5)
 CVE-2026-119282 (Nx is a monorepo solution for TypeScript and polyglot codebases. From  ...)
-	TODO: check
+	NOT-FOR-US: Nx
 CVE-2026-119281 (MariaDB Connector/J is used to connect applications developed in Java  ...)
 	- mariadb-connector-java <unfixed> (bug #1152641)
 	NOTE: https://github.com/mariadb-corporation/mariadb-connector-j/security/advisories/GHSA-grfq-r75j-rw9x
@@ -1751,7 +1751,7 @@ CVE-2026-119203 (pypdf is a free and open-source pure-python PDF library. Prior
 	NOTE: https://github.com/py-pdf/pypdf/pull/4289
 	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a (6.21.4)
 CVE-2026-119202 (@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until ...)
-	TODO: check
+	NOT-FOR-US: @hapi/content
 CVE-2026-119201 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)
 	NOT-FOR-US: Nuxt
 CVE-2026-119200 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)
@@ -1793,11 +1793,11 @@ CVE-2026-119087 (The Content Egg \u2013 Affiliate Product Importer & Price Compa
 CVE-2026-119059 (The Content Egg plugin for WordPress is vulnerable to unauthorized mod ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-118959 (A flaw was found in the required action provider mechanism of Keycloak ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-118952 (A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matchi ...)
-	TODO: check
+	NOT-FOR-US: Red Hat
 CVE-2026-118947 (A flaw was found in the UMA resource registration endpoint of the keyc ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-118698 (The JoomSport \u2013 for Sports: Team & League, Football, Hockey & mor ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-118634 (The Events Made Easy plugin for WordPress is vulnerable to Stored Cros ...)
@@ -2058,9 +2058,9 @@ CVE-2026-107250 (Vulnerability in Drupal ECA Helper. This issue affects ECA Help
 CVE-2026-107249 (Improperly Controlled Modification of Dynamically-Determined Object At ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-107239 (A vulnerability allowing a member of the Veeam Virtualization Extensio ...)
-	TODO: check
+	NOT-FOR-US: Veeam
 CVE-2026-107238 (A vulnerability allowing an authenticated domain user to perform remot ...)
-	TODO: check
+	NOT-FOR-US: Veeam
 CVE-2026-104368 (The Export and Import Users and Customers plugin for WordPress is vuln ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-103963 (A flaw was found in glib-networking. When establishing connections usi ...)
@@ -3459,7 +3459,7 @@ CVE-2026-117859 (A flaw was found in the Pushed Authorization Request PAR implem
 CVE-2026-117688 (A flaw was found in the client registration component of Keycloak, an  ...)
 	- keycloak <itp> (bug #1088287)
 CVE-2026-117627 (A flaw was found in the JWT Authorization Grant implementation of the  ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-117574 (A flaw was found in ai-gateway-payload-processing. An authenticated re ...)
 	NOT-FOR-US: ai-gateway-payload-processing
 CVE-2026-117548 (A NULL pointer dereference flaw was found in 389-ds-base. This flaw oc ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f3ea51f71f45a04ba62f948d09ad26cad7059a3b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f3ea51f71f45a04ba62f948d09ad26cad7059a3b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261101/f3bc2252/attachment.htm>
