[Git][security-tracker-team/security-tracker][master] NFus

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6532f609 by Moritz Muehlenhoff at 2026-11-04T11:03:49+01:00
NFus

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -292,9 +292,9 @@ CVE-2026-61496
 CVE-2026-61495 (TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bo ...)
 	TODO: check
 CVE-2026-57154 (OPNsense is a FreeBSD based firewall and routing platform. Prior to 26 ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-55186 (Silverstripe MFA provides multi-factor authentication for Silverstripe ...)
-	TODO: check
+	NOT-FOR-US: Silverstripe addon
 CVE-2026-54851 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-4052 (This issue only impacts deployments where WSO2 Identity Server is conf ...)
@@ -304,11 +304,11 @@ CVE-2026-46487 (GeoNetwork is a catalog application to manage spatially referenc
 CVE-2026-45146 (Chamilo LMS is an open-source learning management system. Prior to 1.1 ...)
 	NOT-FOR-US: Chamilo LMS
 CVE-2026-44267 (Elo is a purely functional expression language for no-code tools. Prio ...)
-	TODO: check
+	NOT-FOR-US: Elo
 CVE-2026-44266 (Elo is a purely functional expression language for no-code tools. Prio ...)
-	TODO: check
+	NOT-FOR-US: Elo
 CVE-2026-44265 (Elo is a purely functional expression language for no-code tools. Prio ...)
-	TODO: check
+	NOT-FOR-US: Elo
 CVE-2026-43603 (A NULL pointer dereference in the Linux GPU driver could potentially l ...)
 	TODO: check
 CVE-2026-40661 (An out-of-bounds write (OOW) condition in the AMD Compressonator SDK c ...)
@@ -532,9 +532,9 @@ CVE-2026-121506 (An out-of-bounds read and write in NTS client extension field p
 CVE-2026-121505 (An out-of-bounds read in the NTS-KE client response parser (nts_client ...)
 	TODO: check
 CVE-2026-121502 (A vulnerability was identified in mathurvishal CloudClassroom-PHP-Proj ...)
-	TODO: check
+	NOT-FOR-US: CloudClassroom-PHP-Project
 CVE-2026-121501 (A vulnerability was determined in mathurvishal CloudClassroom-PHP-Proj ...)
-	TODO: check
+	NOT-FOR-US: CloudClassroom-PHP-Project
 CVE-2026-121458 (Instatic before 0.0.21 contains a missing authorization vulnerability  ...)
 	TODO: check
 CVE-2026-121455 (DbGate before 7.3.3 contains a missing authorization vulnerability tha ...)
@@ -576,25 +576,25 @@ CVE-2026-121438 (Mistune before 3.3.3 contains a denial of service vulnerability
 CVE-2026-121437 (Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerabi ...)
 	TODO: check
 CVE-2026-121436 (Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vu ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-121435 (Froxlor before 2.3.15 contains an authorization bypass vulnerability t ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-121434 (Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in  ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-121433 (AzuraCast before 0.24.0 contains a stored CSV formula injection vulner ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121432 (AzuraCast before 0.24.0 contains a CRLF injection vulnerability that a ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121431 (AzuraCast before 0.24.0 contains a server-side request forgery vulnera ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121430 (AzuraCast before 0.24.0 contains a missing authorization vulnerability ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121429 (AzuraCast through 0.23.8 contains a command injection vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121428 (AzuraCast through 0.23.8 contains a remote code execution vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121427 (AzuraCast through 0.23.8 fails to remove frontend_config.custom_config ...)
-	TODO: check
+	NOT-FOR-US: AzuraCast
 CVE-2026-121426 (Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulner ...)
 	- node-nodemailer 10.1.7+~8.0.2-1
 	NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6532f6092927f2e8716f984091a690d769f8b58e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6532f6092927f2e8716f984091a690d769f8b58e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/b5a65c65/attachment.htm>