[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Nov 4 07:15:05 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
68cc6df0 by security tracker role at 2026-11-04T07:14:59+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,119 +3,119 @@ CVE-2026-99270 (In the Linux kernel, the following vulnerability has been resolv
CVE-2026-97350 (Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in t ...)
TODO: check
CVE-2026-97072 (Missing Authorization vulnerability in myCred myCred mycred allows Exp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95860 (node-opcua is an OPC UA implementation for TypeScript and Node.js. Fro ...)
TODO: check
CVE-2026-95777 (A sensitive information disclosure vulnerability exists in the managem ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95776 (An authenticated path traversal vulnerability exists in the API of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95775 (A local information disclosure vulnerability exists in the underlying ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95774 (A sensitive information disclosure vulnerability exists in HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95773 (A denial-of-service vulnerability has been identified in HPE Networkin ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95772 (A race condition vulnerability exists in the API of HPE Networking Fab ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95771 (An authenticated information disclosure vulnerability exists in an API ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95770 (A sensitive information disclosure vulnerability in the underlying ope ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95769 (An audit log spoofing vulnerability exists in the API of HPE Networkin ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95768 (A privilege escalation vulnerability exists in the API of HPE Networki ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95767 (An unauthenticated information disclosure vulnerability exists in the ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95766 (Sensitive information disclosure vulnerabilities in HPE Networking Fab ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95765 (A sensitive information disclosure vulnerability exists in the web-bas ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95764 (An improper certificate validation vulnerability exists in the API of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95763 (An improper certificate validation vulnerability in HPE Networking Fab ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95762 (An insufficient session expiration vulnerability exists in the API of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95761 (An improper certificate validation vulnerability exists in HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95760 (A privilege escalation vulnerability exists in the API of HPE Networki ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95759 (Audit log bypass vulnerabilities exist in the API of HPE Networking Fa ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95758 (An authorization bypass vulnerability exists in the API of HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95757 (A local authentication bypass vulnerability exists in an API of HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95756 (A command injection vulnerability exists in the API of HPE Networking ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95755 (Improper certificate validation vulnerabilities in the affected interf ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95753 (A privilege escalation vulnerability exists in the API of HPE Networki ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95752 (A local privilege escalation vulnerability exists in the API of HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95751 (An improper certificate validation vulnerability in the API of HPE Net ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95750 (An improper certificate validation vulnerability in HPE Networking Fab ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95749 (A missing integrity verification vulnerability exists in HPE Networkin ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95748 (A SQL injection vulnerability exists in HPE Networking Fabric Composer ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95747 (A privilege escalation vulnerability exists in the SSH interface of HP ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95746 (An authentication bypass vulnerability in the API endpoint of HPE Netw ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95745 (A vulnerability in the API of HPE Networking Fabric Composer could all ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95744 (A sensitive information disclosure vulnerability in the affected inter ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95743 (Local privilege escalation vulnerabilities exist in the underlying ope ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95742 (An arbitrary file write vulnerability exists in the underlying operati ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95741 (A missing integrity verification vulnerability exists in the API of HP ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95740 (An improper certificate validation vulnerability in HPE Networking Fab ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95739 (An improper restriction of excessive authentication attempts vulnerabi ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95738 (Authentication bypass vulnerabilities in the affected interface of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95737 (A privilege escalation vulnerability exists in the underlying operatin ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95736 (Improper certificate validation vulnerabilities exist in the affected ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95735 (An improper certificate validation vulnerability exists in HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95734 (A sensitive information disclosure vulnerability in the API of HPE Net ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95733 (A vulnerability exists in a component of HPE Networking Fabric Compose ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95732 (An authentication bypass vulnerability exists in the underlying operat ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95731 (Hardcoded password vulnerabilities in the command-line interface of HP ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95730 (A buffer overflow vulnerability exists in HPE Networking VIA that coul ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95729 (A sensitive information disclosure vulnerability exists in HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95728 (An arbitrary file write vulnerability exists in the Virtual Intranet A ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95727 (A command injection vulnerability exists in HPE Networking VIA. Succes ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95726 (A buffer overflow vulnerability in HPE Networking VIA could allow an u ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95725 (A command injection vulnerability exists in the VIA client for Linux. ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95724 (An improper certificate validation vulnerability exists in HPE Network ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95723 (A missing integrity verification vulnerability has been discovered in ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95722 (A local privilege escalation vulnerability has been discovered in the ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-93325 (Buildx bake requires the user to grant entitlements with --allow or an ...)
TODO: check
CVE-2026-92610 (In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect ...)
@@ -155,7 +155,7 @@ CVE-2026-92186 (Quest Foglight for Databases paFnUploadFileAndCreateInfo Directo
CVE-2026-92185 (Quest Foglight for Databases AbstractParser XML External Entity Proces ...)
TODO: check
CVE-2026-91075 (The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89295 (In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding ...)
TODO: check
CVE-2026-89293 (In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 ...)
@@ -169,63 +169,63 @@ CVE-2026-88968 (Claude Code is an agentic coding tool. Prior to 2.1.251, the Edi
CVE-2026-88066 (Claude Desktop is Anthropic's desktop application for interacting with ...)
TODO: check
CVE-2026-87044 (The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim. ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-87043 (The entropy-device random number generator in subsys/random/random_ent ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-87041 (The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-87040 (The nRF link-layer receive paths of the open-source Bluetooth LE Contr ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-87039 (The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-87038 (The user-mode verification handler for the i3c_transfer() system call, ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85036 (The Bluetooth Classic AVDTP layer defers releasing a session's stream ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85035 (The can_add_rx_filter_msgq() system call installs a CAN RX filter whos ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85034 (The Bluetooth host's GATT client passed the value of a received Handle ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85033 (The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps i ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-85032 (The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits R ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-84730 (Stack-based buffer overflow in certain ASUS Router firmware allows an ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-84729 (Out-of-bounds write in certain ASUS Router firmware allow an unauthent ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-82976 (A flaw was found in the image-customization-controller used in OpenShi ...)
- TODO: check
+ NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-82161 (Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82160 (Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82159 (Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82158 (Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82155 (Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untru ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-82154 (Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard- ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80335 (In the bootloader download module, there is a possible out-of-bounds w ...)
- TODO: check
+ NOT-FOR-US: Unisoc
CVE-2026-79405 (In Modem Firmware, there is a possible system crash due to improper in ...)
- TODO: check
+ NOT-FOR-US: Unisoc
CVE-2026-77779 (ManageEngine Key Manager Plus versions before 7151 were vulnerable to ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-77778 (ZohoCorpManageEngine Key Manager Plus versions up to 7150 allow authen ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-77777 (ManageEngine Key Manager Plus versions before 7151 are vulnerable to a ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-77691 (ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow auth ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-77690 (ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulne ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-76894 (CKAN MCP Server is a tool for querying CKAN open data portals. Prior t ...)
TODO: check
CVE-2026-76124 (The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-73328 (Volmarg Personal Management System through 2.1.0 contains an unrestric ...)
TODO: check
CVE-2026-65168 (NVIDIA Slurm contains an attacker-controlled heap-based buffer overflo ...)
@@ -279,7 +279,7 @@ CVE-2026-63198 (traQ is a messenger application built for Digital Creators Club
CVE-2026-63197 (traQ is a messenger application built for Digital Creators Club traP. ...)
TODO: check
CVE-2026-62000 (Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-m ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61497 (TinyUSB before 0.20.1 contains an integer underflow vulnerability in t ...)
TODO: check
CVE-2026-61496
@@ -291,13 +291,13 @@ CVE-2026-57154 (OPNsense is a FreeBSD based firewall and routing platform. Prior
CVE-2026-55186 (Silverstripe MFA provides multi-factor authentication for Silverstripe ...)
TODO: check
CVE-2026-54851 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-4052 (This issue only impacts deployments where WSO2 Identity Server is conf ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-46487 (GeoNetwork is a catalog application to manage spatially referenced res ...)
TODO: check
CVE-2026-45146 (Chamilo LMS is an open-source learning management system. Prior to 1.1 ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-44267 (Elo is a purely functional expression language for no-code tools. Prio ...)
TODO: check
CVE-2026-44266 (Elo is a purely functional expression language for no-code tools. Prio ...)
@@ -315,9 +315,9 @@ CVE-2026-40659 (An integer overflow condition in the AMD Compressonator SDK coul
CVE-2026-40652 (An out-of-bounds read condition in the AMD Compressonator SDK could al ...)
TODO: check
CVE-2026-39777 (Missing Authorization vulnerability in WC Lovers WCFM Membership wc-mu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39743 (Missing Authorization vulnerability in WC Lovers WCFM Membership wc-mu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39379 (GeoNetwork is a catalog application to manage spatially referenced res ...)
TODO: check
CVE-2026-38601 (A hardcoded session secret key in codeskyblue gohttpserver through v1. ...)
@@ -329,21 +329,21 @@ CVE-2026-38595 (An issue in im3x Scriptables through v2-dev branch allows attack
CVE-2026-28531
REJECTED
CVE-2026-28336 (SolarWinds Dameware was found to be affected by a command injection vu ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-28335 (SolarWinds Dameware was found to be affected by a buffer overflow vuln ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-28327 (SolarWinds Dameware was found to be affected by a DLL hijacking vulner ...)
- TODO: check
+ NOT-FOR-US: SolarWinds
CVE-2026-22060 (All versions of StorageGRID (formerly StorageGRID Webscale) in default ...)
- TODO: check
+ NOT-FOR-US: NetApp
CVE-2026-22058 (StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher a ...)
- TODO: check
+ NOT-FOR-US: NetApp
CVE-2026-16900 (Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-16511 (Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rti ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-13594 (Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-121818 (Herowatch Mini developed by About Time Technologies has a system signi ...)
TODO: check
CVE-2026-121817 (Herowatch Go Server developed by About Time Technologies has a Insecur ...)
@@ -375,7 +375,7 @@ CVE-2026-121728 (SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authoriz
CVE-2026-121727 (Kore before 4.3.0 contains an integer underflow vulnerability in HTTP ...)
TODO: check
CVE-2026-121652 (Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-121631 (Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vul ...)
TODO: check
CVE-2026-121628 (Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition ...)
@@ -389,17 +389,17 @@ CVE-2026-121625 (GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds re
CVE-2026-121624 (Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains a ...)
TODO: check
CVE-2026-121621 (A command injection vulnerability was found in Argo CD Image Updater, ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-121618 (A weakness has been identified in Linksys E5600 1.1.0.26. This affects ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121617 (A security flaw has been discovered in Linksys E5600 1.1.0.26. Affecte ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121616 (A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121615 (A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-121614 (Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repos ...)
- TODO: check
+ NOT-FOR-US: Docker products not packaged in Debian
CVE-2026-121610 (A security flaw has been discovered in funadmin 7.1.0. Impacted is the ...)
TODO: check
CVE-2026-121609 (A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.1 ...)
@@ -417,13 +417,13 @@ CVE-2026-121603 (Solanum before commit 2ea1382 contains a buffer overflow vulner
CVE-2026-121602 (Solanum before commit 2ce64de contains a heap-based buffer overflow vu ...)
TODO: check
CVE-2026-121600 (A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affec ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-121599 (A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104 ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-121598 (A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu. ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-121597 (A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B202211 ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-121589 (A weakness has been identified in spatie url-signer up to 2.1.3. Affec ...)
TODO: check
CVE-2026-121588 (TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripti ...)
@@ -439,13 +439,13 @@ CVE-2026-121582 (A vulnerability has been found in Umami up to 3.4.1. Impacted i
CVE-2026-121581 (A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The im ...)
TODO: check
CVE-2026-121580 (Server-side request forgery in the Jira ticketing filter lookup in Dev ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-121578 (Tactical RMM contains a stored XSS vulnerability caused by improperly ...)
TODO: check
CVE-2026-121577 (Inefficient Regular Expression Complexity (CWE-1333) in generate_regex ...)
TODO: check
CVE-2026-121565 (Tanium addressed an improper certificate validation vulnerability in m ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-121564 (Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() ...)
TODO: check
CVE-2026-121562 (CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerabili ...)
@@ -505,7 +505,7 @@ CVE-2026-121522 (In BuildKit versions v0.26.0 through v0.34.1, a specific build
CVE-2026-121520 (In BuildKit versions prior to v0.34.1, a malicious client with access ...)
TODO: check
CVE-2026-121517 (A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected ...)
- TODO: check
+ NOT-FOR-US: IrfanView
CVE-2026-121514 (A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This ...)
TODO: check
CVE-2026-121513 (Off-by-one Heap Overflow in \xb5D3TN v0.15.1 SPP Parser allows Unauthe ...)
@@ -559,7 +559,7 @@ CVE-2026-121444 (svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic
CVE-2026-121443 (svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vul ...)
TODO: check
CVE-2026-121442 (Frappe HRMS before 15.61.0 contains a permission bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-121441 (Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0. ...)
TODO: check
CVE-2026-121440 (Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check ...)
@@ -597,27 +597,27 @@ CVE-2026-121425 (Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in
CVE-2026-121424 (Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulner ...)
TODO: check
CVE-2026-121423 (SurrealDB before 3.3.0 contains an unbounded recursion vulnerability t ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121422 (SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forge ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121421 (SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vu ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121420 (SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forge ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121419 (SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121418 (SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121417 (SurrealDB before 3.3.0 contains a use-after-free vulnerability in surr ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121416 (SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restriction ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-121415 (Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-121414 (Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to c ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-121413 (Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains a ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-121412 (FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource con ...)
TODO: check
CVE-2026-121411 (FreeRDP before 3.32.2 fails to bound server-supplied target dimensions ...)
@@ -673,7 +673,7 @@ CVE-2026-121387 (FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vuln
CVE-2026-121386 (FreeRDP before 3.32.2 contains a denial of service vulnerability in Wi ...)
TODO: check
CVE-2026-121382 (A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-121263 (A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. ...)
TODO: check
CVE-2026-121262 (A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The af ...)
@@ -713,11 +713,11 @@ CVE-2026-120931 (Out of bounds write in WebGL in Google Chrome on on Android pri
CVE-2026-120930 (Incorrect authorization in Blink in Google Chrome prior to 156.0.8078. ...)
TODO: check
CVE-2026-120846 (Missing Authorization vulnerability in Uncanny Owl Uncanny Automator u ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-120843 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-120775 (Tanium addressed a heap-based buffer overflow vulnerability in Deploy.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-120758 (HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability i ...)
TODO: check
CVE-2026-120757 (HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H ...)
@@ -729,13 +729,13 @@ CVE-2026-120755 (HDF5 through 2.2.0 contains an out-of-bounds read vulnerability
CVE-2026-120754 (HDF5 through 2.2.0 contains an uninitialized memory read vulnerability ...)
TODO: check
CVE-2026-120734 (Cleartext transmission of sensitive information in the email configura ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-120733 (Cleartext storage of sensitive information in the user account data in ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-120716 (Insertion of sensitive information into sent data in the identity prov ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-120715 (Server-side request forgery in the Active Directory credential validat ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-120684 (A memory-initialization flaw in the legacy GridFS file handling of the ...)
TODO: check
CVE-2026-120678 (A memory management flaw in the MongoDB C Driver's handling of compres ...)
@@ -745,25 +745,25 @@ CVE-2026-120673 (A component of the MongoDB Rust Driver that records diagnostic
CVE-2026-120567 (The MongoDB Entity Framework Core provider does not neutralize special ...)
TODO: check
CVE-2026-120333 (The actions linked in the emails of the extension (e.g. to confirm a r ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120332 (The HTML content of mails and tracked URLs are rendered unescaped in t ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120331 (Content of external URL mails, their stylesheets and images to embed i ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120330 (Backend actions and ajax routes of the mail module do not check whethe ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120329 (Saving the configuration of the mail backend module writes submitted s ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120328 (The click tracking middleware does not validate the authentication cod ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-120327 (The click tracking middleware accepts an arbitrary target URL and redi ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-11753 (A vulnerability has been identified in armeria-saml versions prior to ...)
TODO: check
CVE-2026-11749 (A vulnerability has been identified in armeria-saml prior to 1.41.1, w ...)
TODO: check
CVE-2026-119922 (Improper access control in the Babelfish for PostgreSQL extension vers ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119742 (Nagios XI before 2026R2 contains an OS command injection vulnerability ...)
TODO: check
CVE-2026-119741 (rsync through 3.5.1 contains a denial of service vulnerability in the ...)
@@ -779,113 +779,113 @@ CVE-2026-119673 (MongoDB Database Tools mongofiles does not resolve existing par
CVE-2026-119672 (MongoDB Database Tools mongofiles uses a database-stored GridFS filena ...)
TODO: check
CVE-2026-119641 (** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-119636 (Improper release of expired privileged access checkouts in the PAM sch ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-119521 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119509 (Missing Authorization vulnerability in eranfl ClickCease Click Fraud P ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119495 (Missing Authorization vulnerability in WebberZone Better Search better ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119487 (Missing Authorization vulnerability in weDevs Dokan dokan-lite allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119485 (Missing Authorization vulnerability in weDevs Dokan dokan-lite allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119215 (Authorization Bypass Through User-Controlled Key vulnerability in team ...)
TODO: check
CVE-2026-119179 (A flaw in the connection management layer of the MongoDB Node.js drive ...)
TODO: check
CVE-2026-119084 (Unsafe reflection in the connection parameter and credentials profile ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-118983 (The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118865 (An authenticated OS command injection vulnerability exists in the Offl ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-118783 (The All-in-One Video Gallery WordPress plugin before 5.0.0 does not v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118637 (The Simple Download Monitor WordPress plugin before 4.1.3 does not pro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118628 (MLflow get-artifacts Server-Side Request Forgery Information Disclosur ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118627 (MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Co ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118626 (MLflow Tracking Server Issues Missing Authorization Privilege Escalati ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118625 (MLflow Tracking Server Missing Authorization Privilege Escalation Vuln ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118624 (MLflow Tracking Server Jobs Missing Authorization Information Disclosu ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118623 (MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remo ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-118527 (Use of predictable filenames in Ivanti Connect Secure before versions ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-118523 (The EventPrime WordPress plugin before 4.3.6.1 does not keep the buil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118505 (Improper Restriction of Excessive Authentication Attempts vulnerabilit ...)
TODO: check
CVE-2026-118489 (In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one`C ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-118488 (In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a m ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-118487 (In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `Fra ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-118448 (A use of uninitialized memory vulnerability in the pybddisasm Python b ...)
- TODO: check
+ NOT-FOR-US: Bitdefender
CVE-2026-118447 (A use of uninitialized memory vulnerability in the pybddisasm Python b ...)
- TODO: check
+ NOT-FOR-US: Bitdefender
CVE-2026-118446 (A use-after-free vulnerability in the pybddisasm Python bindings affec ...)
- TODO: check
+ NOT-FOR-US: Bitdefender
CVE-2026-118445 (A use-after-free vulnerability in the pybddisasm Python bindings affec ...)
- TODO: check
+ NOT-FOR-US: Bitdefender
CVE-2026-118444 (Out-of-bounds read vulnerabilities in the pybddisasm Python bindings m ...)
- TODO: check
+ NOT-FOR-US: Bitdefender
CVE-2026-118422 (The Stape Conversion Tracking WordPress plugin before 2.3.11 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118407 (The Premium Packages WordPress plugin before 7.3.1 does not verify th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118404 (The Premium Packages WordPress plugin before 7.3.1 does not verify ow ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118403 (The Premium Packages WordPress plugin before 7.3.1 does not verify th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118237 (An out-of-bounds read vulnerability was identified in GitHub Enterpris ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-116859 (Missing Authorization vulnerability in WPMU DEV Forminator forminator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116858 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116845 (NetBox from 2.9.0 before 4.7.4 contains a broken access control vulner ...)
TODO: check
CVE-2026-116669 (Tanium addressed an improper access controls vulnerability in Discover ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116668 (Tanium addressed an uncontrolled resource consumption vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116667 (Tanium addressed an improper access controls vulnerability in Discover ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116666 (Tanium addressed an information disclosure vulnerability in Discover.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116665 (Tanium addressed an information disclosure vulnerability in Discover.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116664 (Tanium addressed an improper access controls vulnerability in Discover ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116663 (Tanium addressed an improper access controls vulnerability in Enforce.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116661 (Tanium addressed an improper access controls vulnerability in Enforce.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116654 (Tanium addressed an improper input validation vulnerability in Threat ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116653 (Tanium addressed an improper input validation vulnerability in Threat ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116652 (Tanium addressed a business logic error in Threat Response.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116651 (Tanium addressed an unauthorized code execution vulnerability in Threa ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116650 (Tanium addressed an unauthorized code execution vulnerability in Threa ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116648 (Tanium addressed an improper output sanitization vulnerability in Disc ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-116646 (Tanium addressed an uncontrolled resource consumption vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-115878 (Stanza is a Stanford NLP Python library for tokenization, sentence seg ...)
TODO: check
CVE-2026-115779 (Effect is a TypeScript framework that consists of several packages tha ...)
@@ -895,79 +895,79 @@ CVE-2026-115732 (Incorrect authorization in the certificate-name matching of tra
CVE-2026-115731 (Deserialization of untrusted data in the report-processing code of Pup ...)
TODO: check
CVE-2026-115716 (Allocation of Resources Without Limits or Throttling (CWE-770) in APM ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115715 (Allocation of Resources Without Limits or Throttling (CWE-770) in Elas ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115714 (Improper Certificate Validation (CWE-295) in the operating system cert ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115710 (Use of Cache Containing Sensitive Information (CWE-524) in Elasticsear ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115541 (HumHub Community Edition 1.19.0 contains a stored cross-site scripting ...)
TODO: check
CVE-2026-115426 (The WPvivid \u2014 Backup, Migration & Staging WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115298 (Incorrect Authorization (CWE-863) in Elasticsearch can lead to informa ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115297 (NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Pack ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115295 (Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana c ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115294 (Improper Limitation of a Pathname to a Restricted Directory (CWE-22) i ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115293 (Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115292 (Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana M ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115290 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial o ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115289 (Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM S ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115262 (The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115257 (The WP Roster WordPress plugin before 2.36 does not perform any capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115250 (The Text Typing WordPress plugin before 2.2.2 does not properly sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115243 (The WPvivid \u2014 Backup, Migration & Staging WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115242 (The WPvivid \u2014 Backup, Migration & Staging WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115241 (The WPvivid \u2014 Backup, Migration & Staging WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115231 (In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Man ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-114552 (MailEnable parseObjectResponse XML External Entity Processing Informat ...)
- TODO: check
+ NOT-FOR-US: MailEnable
CVE-2026-114551 (MailEnable Auth Cleartext Storage Information Disclosure Vulnerability ...)
- TODO: check
+ NOT-FOR-US: MailEnable
CVE-2026-114550 (libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write ...)
TODO: check
CVE-2026-114549 (NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution ...)
TODO: check
CVE-2026-114442 (Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-114431 (The Enable Media Replace WordPress plugin before 4.2.3 does not pass a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114187 (Missing Authorization vulnerability in WPVibes AnyWhere Elementor anyw ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114185 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114183 (Insertion of Sensitive Information Into Sent Data vulnerability in WPV ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-113421 (In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Module ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-112917 (In Docker Desktop for Windows with the WSL2 backend, an unprivileged L ...)
- TODO: check
+ NOT-FOR-US: Docker products not packaged in Debian
CVE-2026-112354 (Etrel INCH AC charging station management web interface prior to firmw ...)
TODO: check
CVE-2026-112244 (The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112243 (The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112116 (An exposed IOCTL with insufficient access control in ASUS System Contr ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-111962 (The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111754 (Angular is a development platform for building mobile and desktop web ...)
TODO: check
CVE-2026-111752 (Angular is a development platform for building mobile and desktop web ...)
@@ -975,39 +975,39 @@ CVE-2026-111752 (Angular is a development platform for building mobile and deskt
CVE-2026-111751 (Angular is a development platform for building mobile and desktop web ...)
TODO: check
CVE-2026-111740 (The Post Duplicator WordPress plugin before 3.0.17 does not check whet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111085
REJECTED
CVE-2026-110964 (The Essential Real Estate WordPress plugin before 5.3.5 does not verif ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110826 (Improper Session Invalidation after Authentication Credential Change v ...)
TODO: check
CVE-2026-110692 (The PowerPack Addons for Elementor: Widgets, Form Styler and Templates ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110464 (Missing authorization in ASUS Armoury Crate allows a local attacker to ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-110288 (A cross-site request forgery vulnerability was identified in GitHub En ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-110265 (A specially crafted malformed search query could return results from o ...)
TODO: check
CVE-2026-109836 (The Core Temp kernel driver provided by ALCPU is vulnerable to insuffi ...)
TODO: check
CVE-2026-109594 (Post-authentication Improper Neutralization of Special Elements used i ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-109593 (An unauthenticated attacker with network access to the SonicWall GMS 9 ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-109161 (Insufficient bounds checking in the Digital I/O function may allow a r ...)
TODO: check
CVE-2026-108516
REJECTED
CVE-2026-108327 (Tanium addressed a path traversal vulnerability in Tanium Data Service ...)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-108324 (Tanium addressed a denial of service vulnerability in Tanium Client.)
- TODO: check
+ NOT-FOR-US: Tanium
CVE-2026-108068 (The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108067 (The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108060 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
TODO: check
CVE-2026-108059 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
@@ -1039,15 +1039,15 @@ CVE-2026-108047 (Inadequate authorization vulnerability in Alosuite\u2019s user
CVE-2026-108046 (Direct Object Reference (IDOR) vulnerability in Alosuite due to insuff ...)
TODO: check
CVE-2026-108041 (The SEOPress WordPress plugin before 10.4 does not sanitise and escap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107916
REJECTED
CVE-2026-106991 (hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Con ...)
TODO: check
CVE-2026-106649 (The Kali Forms \u2014 Contact Form & Drag-and-Drop Builder WordPress p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106000 (The Booking Package WordPress plugin before 1.7.34 does not require pa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105982 (Improper input validation in the IPsec VPN function may allow a remote ...)
TODO: check
CVE-2026-105981 (Improper input validation in the Digital I/O function may allow a remo ...)
@@ -1059,33 +1059,33 @@ CVE-2026-105979 (Improper input validation in the ZeroTier VPN function may allo
CVE-2026-105978 (Improper input validation in management control functions may allow a ...)
TODO: check
CVE-2026-105822 (The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105821 (The Tapo Cloud MQTT broker contains a broken access control vulnerabil ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105413 (The Form Maker by 10Web WordPress plugin before 1.15.51 does not cons ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105296 (Multiple Akeeba products lack the anti-CSRF check on some actions. If ...)
TODO: check
CVE-2026-105191 (The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104719 (The CookieYes WordPress plugin before 3.5.8 does not correctly restri ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104608 (A remote code execution vulnerability was identified in GitHub Enterpr ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-103916 (Docker Sandboxes sbx cp does not safely confine host-side paths to a s ...)
- TODO: check
+ NOT-FOR-US: Docker products not packaged in Debian
CVE-2026-103653 (An out-of-bounds read vulnerability in the Qt CoAP message parsing (QC ...)
TODO: check
CVE-2026-103429
REJECTED
CVE-2026-103327 (The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103077 (Missing Authorization vulnerability in myCred myCred mycred allows Exp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-101166 (The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101165 (The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100493 (An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK ...)
TODO: check
CVE-2025-71452 (Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scr ...)
@@ -1093,7 +1093,7 @@ CVE-2025-71452 (Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-si
CVE-2025-71451 (Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scr ...)
TODO: check
CVE-2025-11229 (The system fails to properly enforce scope authorization when the `aut ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-120572 (Incorrect boundary conditions in the Layout: Block and Inline componen ...)
- firefox 159.0.1-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-123/#CVE-2026-120572
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68cc6df02b1e9c7437747e866848832be5d60b61
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68cc6df02b1e9c7437747e866848832be5d60b61
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/878b2e0b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list