[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ec066c23 by Moritz Muehlenhoff at 2026-11-03T12:31:46+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -518,29 +518,29 @@ CVE-2026-120432 (Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an inte
 CVE-2026-120431 (Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.0 ...)
 	TODO: check
 CVE-2026-120430 (Camaleon CMS before 2.9.2 contains an insecure direct object reference ...)
-	TODO: check
+	NOT-FOR-US: Camaleon CMS
 CVE-2026-120429 (Camaleon CMS before 2.9.2 contains a missing authorization vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: Camaleon CMS
 CVE-2026-120428 (PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting ...)
-	TODO: check
+	NOT-FOR-US: PandaWiki
 CVE-2026-120427 (MrDoc through 1.1.1 contains a missing authorization vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: MrDoc
 CVE-2026-120426 (OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenCSG CSGHub
 CVE-2026-120425 (Chatify before 1.6.4 contains an authorization bypass vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: Chatify
 CVE-2026-120416 (A security vulnerability has been detected in AndyFactory newspaper4k  ...)
-	TODO: check
+	NOT-FOR-US: newspaper4k
 CVE-2026-120318 (Product Gallery Slider & Additional Variation Images for WooCommerce 2 ...)
-	TODO: check
+	NOT-FOR-US: WooCommerce plugin
 CVE-2026-120216 (fastify is a web framework for Node.js. In versions 5.8.0 through 5.12 ...)
-	TODO: check
+	NOT-FOR-US: Node fastify
 CVE-2026-120215 (@fastify/cors is the CORS plugin for the Fastify web framework. In ver ...)
-	TODO: check
+	NOT-FOR-US: @fastify/cors
 CVE-2026-120214 (@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to  ...)
-	TODO: check
+	NOT-FOR-US: @fastify/cors
 CVE-2026-120213 (@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to  ...)
-	TODO: check
+	NOT-FOR-US: @fastify/cors
 CVE-2026-120091 (Temporal Server compiles a Worker Controller Instance module, go.tempo ...)
 	NOT-FOR-US: Temporal Technologies
 CVE-2026-120067 (For updatable cursors, which are enabled by default, psqlODBC adds hid ...)
@@ -587,15 +587,15 @@ CVE-2026-119737 (The pppoe_wrapper vendor daemon from the Amlogic Android SDK, a
 CVE-2026-119736 (Attendo (formerly Petpooja Payroll) Admin Android application version  ...)
 	TODO: check
 CVE-2026-119735 (Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site s ...)
-	TODO: check
+	NOT-FOR-US: Munshi
 CVE-2026-119734 (Munshi (by Petpooja) before 2026-06-17 contained a broken object level ...)
-	TODO: check
+	NOT-FOR-US: Munshi
 CVE-2026-119733 (Munshi (by Petpooja) before 2026-07-07 contained a missing authorizati ...)
-	TODO: check
+	NOT-FOR-US: Munshi
 CVE-2026-119732 (Munshi (by Petpooja) before 2026-07-28 contained a broken object level ...)
-	TODO: check
+	NOT-FOR-US: Munshi
 CVE-2026-119731 (Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: Munshi
 CVE-2026-119301 (Improper neutralization of quoting syntax in SQL identifier constructi ...)
 	NOT-FOR-US: Amazon
 CVE-2026-119085 (Improper neutralization of special elements used in a template engine  ...)
@@ -605,13 +605,13 @@ CVE-2026-118871 (SQL injection vulnerability classified as an internal threat le
 CVE-2026-118052 (In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Man ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-117549 (@fastify/secure-session is a session plugin for Fastify that stores an ...)
-	TODO: check
+	NOT-FOR-US: @fastify/secure-session
 CVE-2026-117531 (@fastify/multipart is the multipart form-data and file upload plugin f ...)
-	TODO: check
+	NOT-FOR-US: @fastify/multipart
 CVE-2026-117518 (@fastify/reply-from is a Fastify plugin that forwards requests to an u ...)
-	TODO: check
+	NOT-FOR-US: @fastify/reply-from
 CVE-2026-117127 (Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a r ...)
-	TODO: check
+	NOT-FOR-US: GleezCMS
 CVE-2026-117082 (An authentication bypass vulnerability in the Universal Plug and Play  ...)
 	TODO: check
 CVE-2026-117069 (An integer truncation vulnerability in the NAS decoder of OpenAirInter ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec066c23dcad7369b6751e00480291cb313a70fd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec066c23dcad7369b6751e00480291cb313a70fd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/edb85577/attachment-0001.htm>