[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Nov 4 19:57:09 GMT 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b43a4c76 by Salvatore Bonaccorso at 2026-11-04T20:56:45+01:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,75 +3,75 @@ CVE-2026-97705 (Moleculer is a progressive microservices framework for Node.js.
 CVE-2026-97701 (Zulip is an open-source team collaboration tool. In Zulip Server versi ...)
 	TODO: check
 CVE-2026-97397 (The Remove Google Fonts \u2013 Disable, Block, or Replace with Bunny F ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-95649 (IRISPowerscan insufficiently restrict the use of untrusted scripts. An ...)
-	TODO: check
+	NOT-FOR-US: Canon
 CVE-2026-94460 (IRISPowerscan contain an insecure default configuration where the buil ...)
-	TODO: check
+	NOT-FOR-US: Canon
 CVE-2026-94459 (IRISPowerscan contain default user accounts with predictable credentia ...)
-	TODO: check
+	NOT-FOR-US: Canon
 CVE-2026-93900 (The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is v ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-92704 (SharpEmu is an experimental PlayStation 5 emulator for Windows and Lin ...)
 	TODO: check
 CVE-2026-91168 (Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linu ...)
-	TODO: check
+	NOT-FOR-US: Warpgate
 CVE-2026-91163 (Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linu ...)
-	TODO: check
+	NOT-FOR-US: Warpgate
 CVE-2026-90634 (An uncontrolled memory access in the PDF import code of Apache OpenOff ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90632 (Apache OpenOffice documents can include multimedia content (audio, vid ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90631 (Apache OpenOffice documents can contain links. A missing Authorization ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90629 (An uncontrolled memory access in the WMF import code of Apache OpenOff ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90628 (An uncontrolled memory access in the PDF export code of Apache OpenOff ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90627 (The flat file database driver in Apache Openoffice versions through 4. ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90626 (An uncontrolled memory access in the PDF import code of Apache OpenOff ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-90624 (An unchecked memory access in the PDF import code of Apache OpenOffice ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82033 (DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e240 ...)
 	TODO: check
 CVE-2026-82029 (Invoice Ninja before 5.13.28 contains a broken access control vulnerab ...)
 	TODO: check
 CVE-2026-76506 (A vulnerability in the web-based management interface of Cisco UCS Cen ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2026-76419 (A vulnerability in the web-based management interface of Cisco Unified ...)
-	TODO: check
+	NOT-FOR-US: Cisco
 CVE-2026-66736
 	REJECTED
 CVE-2026-65555 (Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny To ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-63183 (OmniAuth is a flexible authentication system utilizing Rack middleware ...)
 	TODO: check
 CVE-2026-62126 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-62007 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-59268 (An out-of-bounds Write vulnerability in Apache OpenOffice versions thr ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-59267 (A crafted DXF document causes a heap buffer overflow in Draw in Apache ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-59264 (The Windows installers of Apache OpenOffice 4.1.16 and earlier allow a ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-59263 (A manipulated document opened in Apache OpenOffice 4.1.16 or earlier m ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-57853 (DataGerry before 3.3.0 contains a server-side template injection vulne ...)
 	TODO: check
 CVE-2026-57775 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-57666 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-57639 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-56065 (Insertion of Sensitive Information into Externally-Accessible File or  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-54861 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-39431 (On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API func ...)
 	TODO: check
 CVE-2026-39430 (On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator a ...)
@@ -113,7 +113,7 @@ CVE-2026-121967 (Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 befo
 CVE-2026-121966 (Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth sub ...)
 	TODO: check
 CVE-2026-121965 (Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a ...)
-	TODO: check
+	NOT-FOR-US: Parse Server
 CVE-2026-121946 (zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a ...)
 	TODO: check
 CVE-2026-121945 (CoopCycle coopcycle-web before 6.20.1 contains a broken access control ...)
@@ -137,13 +137,13 @@ CVE-2026-121937 (loonflow before r3.2.3 contains a missing authorization vulnera
 CVE-2026-121936 (easyVoice before 0.0.23 contains a server-side request forgery vulnera ...)
 	TODO: check
 CVE-2026-121933 (A flaw has been found in Linksys E5350 1.0.00.037. This impacts the fu ...)
-	TODO: check
+	NOT-FOR-US: Linksys
 CVE-2026-121932 (A vulnerability was detected in Linksys E5350 1.0.00.037. This affects ...)
-	TODO: check
+	NOT-FOR-US: Linksys
 CVE-2026-121931 (A security vulnerability has been detected in Linksys WRT54GL 4.30.18. ...)
-	TODO: check
+	NOT-FOR-US: Linksys
 CVE-2026-121930 (A weakness has been identified in Linksys WRT54GL 4.30.18. The affecte ...)
-	TODO: check
+	NOT-FOR-US: Linksys
 CVE-2026-121929 (A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. ...)
 	TODO: check
 CVE-2026-121928 (A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. Thi ...)
@@ -155,13 +155,13 @@ CVE-2026-121926 (A vulnerability was detected in yezhihao jt808-server up to a07
 CVE-2026-121925 (A stack-based buffer overflow in libsnowflakeclient and the Snowflake  ...)
 	TODO: check
 CVE-2026-121640 (An Authentication Bypass by Capture-replay vulnerability in WatchGuard ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-121639 (A Missing Authentication for Critical Function vulnerability in WatchG ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-121638 (An Improper Certificate Validation vulnerability in WatchGuard AuthPoi ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-121637 (An improper integrity validation vulnerability in WatchGuard AuthPoint ...)
-	TODO: check
+	NOT-FOR-US: WatchGuard
 CVE-2026-121620 (CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authent ...)
 	TODO: check
 CVE-2026-121373 (The Symfony HtmlSanitizer componentMetaRefreshAttributeSanitizer, intr ...)
@@ -175,7 +175,7 @@ CVE-2026-121145 (This vulnerability exists in the iRA 2.0 and iRA.ev mobile appl
 CVE-2026-121144 (This vulnerability exists in the iRA 2.0 and iRA.ev mobile application ...)
 	TODO: check
 CVE-2026-120554 (The Import and export users and customers plugin for WordPress is vuln ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-120422 (Sogou Input Method for Windows contains a vulnerability in the configu ...)
 	TODO: check
 CVE-2026-120421 (In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19 ...)
@@ -193,13 +193,13 @@ CVE-2026-119746 (ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) co
 CVE-2026-119745 (Sender plugin for WordPress before 2.11.3 contains a missing authoriza ...)
 	TODO: check
 CVE-2026-119481 (Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuil ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-119477 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-119468 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-119366 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-118516 (The Symfony Routing componentsCompiledUrlMatcher and UrlMatcherinterpr ...)
 	TODO: check
 CVE-2026-118513 (Authentication bypass by spoofing inX509AuthenticatorandX509Authentica ...)
@@ -209,7 +209,7 @@ CVE-2026-118391 (Allocation of Resources Without Limits or Throttling vulnerabil
 CVE-2026-115574 (Zulip is an open-source team collaboration tool. From 11.0 until 12.2, ...)
 	TODO: check
 CVE-2026-115498 (The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-115474 (Zulip is an open-source team collaboration tool. From 8.0 until 12.2,  ...)
 	TODO: check
 CVE-2026-115448 (Uncontrolled recursion in Apache ZooKeeper. The server serializes its  ...)
@@ -265,7 +265,7 @@ CVE-2026-107479 (An integer truncation vulnerability in the QTextCodec conversio
 CVE-2026-106554 (One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an ...)
 	TODO: check
 CVE-2026-104799 (The Mobile builder plugin for WordPress is vulnerable to Privilege Esc ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-103582 (Unbounded memory allocation and missing frame size validation in Apach ...)
 	TODO: check
 CVE-2026-102345 (Zammad is a web based open source helpdesk/customer support system. Pr ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b43a4c762b1394d4b2402f4de0446a82ca9a7337

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b43a4c762b1394d4b2402f4de0446a82ca9a7337
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/ce1938db/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list