[Git][security-tracker-team/security-tracker][master] Process some more NFUs

Mon Nov 2 12:02:54 GMT 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b085ea39 by Salvatore Bonaccorso at 2026-11-02T12:58:07+01:00
Process some more NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -233,9 +233,9 @@ CVE-2026-120277 (A security vulnerability has been detected in WAVLINK WN536AX6-
 CVE-2026-120276 (A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. Th ...)
 	NOT-FOR-US: Wavlink
 CVE-2026-120275 (A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technolog ...)
-	TODO: check
+	NOT-FOR-US: Shanghai Xi Yu Ji ZhiTechnology Minimax Code
 CVE-2026-120274 (A vulnerability was identified in beecue FastBee up to 2.1.0. Affected ...)
-	TODO: check
+	NOT-FOR-US: beecue FastBee
 CVE-2026-120263 (When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the defau ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-120242 (A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P ...)
@@ -259,7 +259,7 @@ CVE-2026-120234 (A weakness has been identified in ag-ui-protocol ag-ui up to 0.
 CVE-2026-120233 (A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0. ...)
 	NOT-FOR-US: ag-ui-protocol ag-ui
 CVE-2026-120232 (A vulnerability was identified in Horizon DataSys Reboot Restore Stand ...)
-	TODO: check
+	NOT-FOR-US: Horizon DataSys Reboot Restore Standard
 CVE-2026-120231 (A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The ...)
 	NOT-FOR-US: Wavlink
 CVE-2026-120230 (A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the f ...)
@@ -271,13 +271,13 @@ CVE-2026-120228 (A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This
 CVE-2026-120227 (A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This af ...)
 	NOT-FOR-US: Wavlink
 CVE-2026-120226 (A security vulnerability has been detected in Hangzhou Xiongmai Techno ...)
-	TODO: check
+	NOT-FOR-US: Hangzhou Xiongmai Technology P2PAPI.dll
 CVE-2026-120225 (A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1.  ...)
-	TODO: check
+	NOT-FOR-US: Oray Pugongying X5 Pro
 CVE-2026-120224 (A security flaw has been discovered in Oray Pugongying X5 Pro up to 7. ...)
-	TODO: check
+	NOT-FOR-US: Oray Pugongying X5 Pro
 CVE-2026-120223 (A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1.  ...)
-	TODO: check
+	NOT-FOR-US: Oray Pugongying X5 Pro
 CVE-2026-119627 (The web profile and RSS/Atom feed routes of users and organizations ch ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-119625 (The `/{username}` web route accepted personal access tokens over HTTP  ...)
@@ -299,7 +299,7 @@ CVE-2026-118386 (Workflows triggered by a pull request review were read from the
 CVE-2026-117685 (The OCI registry's cross-repository blob mount checked the target pack ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-117680 (Improper Check for Unusual or Exceptional Conditions vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: lud jsv (Json Schema Validator for Elixir)
 CVE-2026-117677 (When parsing an uploaded Helm chart, Gitea decompressed the archive an ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-117649 (The issue timeline API and the web issue page hid cross-reference even ...)
@@ -7836,19 +7836,19 @@ CVE-2026-116870 (In affected versions of Octopus Server, OIDC token issuer valid
 CVE-2026-116863 (Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-116683 (CTFer.io's CTFd Terraform Provider manages CTFd resources as code. Fro ...)
-	TODO: check
+	NOT-FOR-US: CTFd Terraform Provider
 CVE-2026-116682 (FileBrowser Quantum is a free, self-hosted, web-based file manager. Pr ...)
-	TODO: check
+	NOT-FOR-US: FileBrowser Quantum
 CVE-2026-116680 (HomeBox is a home inventory and organization system. Prior to version  ...)
-	TODO: check
+	NOT-FOR-US: HomeBox
 CVE-2026-116679 (Neko is a a self-hosted virtual browser that runs in Docker and uses W ...)
-	TODO: check
+	NOT-FOR-US: Neko
 CVE-2026-116678 (Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to ...)
 	- vaultwarden <itp> (bug #1067023)
 CVE-2026-116677 (OpenWISP Controller is a network and WiFi controller for provisioning, ...)
-	TODO: check
+	NOT-FOR-US: OpenWISP Controller
 CVE-2026-116676 (Atlantis is a self-hosted golang application that listens for Terrafor ...)
-	TODO: check
+	NOT-FOR-US: Atlantis
 CVE-2026-116675 (TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and ...)
 	TODO: check
 CVE-2026-116674 (systeminformation is a System and OS information library for node.js.  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b085ea39bb019e33d7da1a7aa1283def9b782610

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b085ea39bb019e33d7da1a7aa1283def9b782610
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/7b2dca33/attachment.htm>
