[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Wed Nov 4 12:40:44 GMT 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ae877da2 by Moritz Muehlenhoff at 2026-11-04T13:40:14+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -768,13 +768,13 @@ CVE-2026-119741 (rsync through 3.5.1 contains a denial of service vulnerability
 CVE-2026-119724 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive enti ...)
 	TODO: check
 CVE-2026-119675 (MongoDB Database Tools mongorestore inconsistently handles the system. ...)
-	TODO: check
+	- mongo-tools <removed>
 CVE-2026-119674 (MongoDB Database Tools mongorestore incorrectly URL-decodes an origina ...)
-	TODO: check
+	- mongo-tools <removed>
 CVE-2026-119673 (MongoDB Database Tools mongofiles does not resolve existing parent-dir ...)
-	TODO: check
+	- mongo-tools <removed>
 CVE-2026-119672 (MongoDB Database Tools mongofiles uses a database-stored GridFS filena ...)
-	TODO: check
+	- mongo-tools <removed>
 CVE-2026-119641 (** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerabilit ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-119636 (Improper release of expired privileged access checkouts in the PAM sch ...)
@@ -1006,55 +1006,55 @@ CVE-2026-108068 (The FV Flowplayer Video Player WordPress plugin before 7.5.56.7
 CVE-2026-108067 (The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 doe ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-108060 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108059 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108058 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108057 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108056 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108055 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108054 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108053 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108052 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108051 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108050 (A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that aff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108049 (Clickjacking vulnerability in the Alosuite web application. The affect ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108048 (Vulnerability due to a lack of request limits in Alosuite\u2019s passw ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108047 (Inadequate authorization vulnerability in Alosuite\u2019s user invitat ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108046 (Direct Object Reference (IDOR) vulnerability in Alosuite due to insuff ...)
-	TODO: check
+	NOT-FOR-US: Alosuite
 CVE-2026-108041 (The SEOPress  WordPress plugin before 10.4 does not sanitise and escap ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-107916
 	REJECTED
 CVE-2026-106991 (hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Con ...)
-	TODO: check
+	NOT-FOR-US: hustoj
 CVE-2026-106649 (The Kali Forms \u2014 Contact Form & Drag-and-Drop Builder WordPress p ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-106000 (The Booking Package WordPress plugin before 1.7.34 does not require pa ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105982 (Improper input validation in the IPsec VPN function may allow a remote ...)
-	TODO: check
+	NOT-FOR-US: Welotec TK100
 CVE-2026-105981 (Improper input validation in the Digital I/O function may allow a remo ...)
-	TODO: check
+	NOT-FOR-US: Welotec TK100
 CVE-2026-105980 (Improper input validation in the WireGuard VPN function may allow a re ...)
-	TODO: check
+	NOT-FOR-US: Welotec TK100
 CVE-2026-105979 (Improper input validation in the ZeroTier VPN function may allow a rem ...)
-	TODO: check
+	NOT-FOR-US: Welotec TK100
 CVE-2026-105978 (Improper input validation in management control functions may allow a  ...)
-	TODO: check
+	NOT-FOR-US: Welotec TK100
 CVE-2026-105822 (The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF ...)
 	NOT-FOR-US: TPLink
 CVE-2026-105821 (The Tapo Cloud MQTT broker contains a broken access control vulnerabil ...)
@@ -1062,7 +1062,7 @@ CVE-2026-105821 (The Tapo Cloud MQTT broker contains a broken access control vul
 CVE-2026-105413 (The Form Maker by 10Web  WordPress plugin before 1.15.51 does not cons ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105296 (Multiple Akeeba products lack the anti-CSRF check on some actions. If  ...)
-	TODO: check
+	NOT-FOR-US: Akeeba
 CVE-2026-105191 (The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Wor ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104719 (The CookieYes  WordPress plugin before 3.5.8 does not correctly restri ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae877da281dc6076c1f43ac72391a0ad71f7c71a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae877da281dc6076c1f43ac72391a0ad71f7c71a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/f1a023da/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list