[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 06:17:10 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
172b3c40 by Salvatore Bonaccorso at 2026-10-01T07:16:46+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -250,7 +250,7 @@ CVE-2026-93624 (Shop manager PHP Object Injection in Music Player for WooCommerc
CVE-2026-93621 (Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93547 (A missing authorization check in the Vaadin Spreadsheet component allo ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-93514 (Unauthenticated Cross Site Scripting (XSS) in Notification for Telegra ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress ...)
@@ -293,7 +293,7 @@ CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using
- wss4j <unfixed>
NOTE: https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-contro ...)
- wss4j <unfixed>
NOTE: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
@@ -802,17 +802,17 @@ CVE-2026-102490 (All versions of Zammad including the latest alpha enable the lo
CVE-2026-102489 (Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnera ...)
TODO: check
CVE-2026-102459 (EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scriptin ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102458 (EasyFlow .NET developed by Digiwin has a Missing Authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102457 (EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerab ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102456 (EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102455 (EasyFlow .NET developed by Digiwin has a Insecure Deserialization vuln ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102454 (EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulner ...)
- TODO: check
+ NOT-FOR-US: Digiwin
CVE-2026-102427 (Joomla Extension - ordasoft.com - Unauthenticated Remote Code Executio ...)
NOT-FOR-US: Joomla
CVE-2026-102399 (Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by ...)
@@ -842,7 +842,7 @@ CVE-2026-102376 (Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versi
CVE-2026-102375 (Subscriber Broken Access Control in Optimole <= 4.2.14 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-101295 (Path traversal / arbitrary file write in oc-mirror's operator catalog ...)
- TODO: check
+ NOT-FOR-US: openshift/oc-mirror
CVE-2026-100513 (Contributor Cross Site Scripting (XSS) in CF7 Views – Complete E ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100512 (Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.)
@@ -1041,7 +1041,7 @@ CVE-2026-79534 (mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directo
CVE-2026-79417 (Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMo ...)
NOT-FOR-US: Argotronic eGbR ArgusMonitor
CVE-2026-79403 (An issue in Kilo Code before v7.4.1 allows a local attacker to execute ...)
- TODO: check
+ NOT-FOR-US: Kilo Code
CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level authorization ...)
NOT-FOR-US: KitchenAsty
CVE-2026-78229 (Image Scanner Driver for Linux contains an OS command injection vulner ...)
@@ -1185,9 +1185,9 @@ CVE-2026-103100 (Pexip Infinity before 40.1 is affected by improper input valida
CVE-2026-103099 (Pexip Infinity before 41.1 is affected by improper input validation in ...)
NOT-FOR-US: Pexip Infinity
CVE-2026-103088 (Handlebars.java before 4.5.5 allows directory traversal. In handlebars ...)
- TODO: check
+ NOT-FOR-US: Handlebars.java
CVE-2026-103087 (Uncontrolled recursion in the Gosub browser engine (gosub-engine) thro ...)
- TODO: check
+ NOT-FOR-US: Gosub browser engine (gosub-engine)
CVE-2026-103057 (AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vu ...)
NOT-FOR-US: AiSOC
CVE-2026-103056 (AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnera ...)
@@ -1215,7 +1215,7 @@ CVE-2026-103045 (Improper neutralization of input during web page generation ('c
CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in The Wikimed ...)
TODO: check
CVE-2026-103043 (anchorme through 3.0.8 contains a regular expression denial of service ...)
- TODO: check
+ NOT-FOR-US: anchorme Node.js module
CVE-2026-103042 (LightLLM through 1.2.0 contains a memory exhaustion vulnerability in t ...)
NOT-FOR-US: LightLLM
CVE-2026-103041 (LightLLM through 1.2.0 multimodal deployments expose an unauthenticate ...)
@@ -1235,7 +1235,7 @@ CVE-2026-102913 (A security flaw has been discovered in SourceCodester Car Drivi
CVE-2026-102912 (A vulnerability was identified in SourceCodester Online Leave Manageme ...)
NOT-FOR-US: SourceCodester
CVE-2026-102911 (A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is ...)
- TODO: check
+ NOT-FOR-US: zosmaai pi-llm-wiki
CVE-2026-102910 (A security flaw has been discovered in SourceCodester Online Reviewer ...)
NOT-FOR-US: SourceCodester
CVE-2026-102909 (A vulnerability was identified in SourceCodester Online Reviewer Manag ...)
@@ -1243,17 +1243,17 @@ CVE-2026-102909 (A vulnerability was identified in SourceCodester Online Reviewe
CVE-2026-102908 (A vulnerability was determined in SourceCodester Online Reviewer Manag ...)
NOT-FOR-US: SourceCodester
CVE-2026-102906 (A vulnerability was identified in 0xshariq github-mcp-server up to 52e ...)
- TODO: check
+ NOT-FOR-US: 0xshariq github-mcp-server
CVE-2026-102904 (JupyterLab is an extensible environment for interactive and reproducib ...)
- jupyterlab <unfixed>
NOTE: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv
NOTE: https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f (v4.6.4)
CVE-2026-102879 (ClaraVerse through 0.3.1 contains server-side request forgery protecti ...)
- TODO: check
+ NOT-FOR-US: ClaraVerse
CVE-2026-102878 (mcp-chrome-bridge through 1.0.31 contains an origin validation error i ...)
- TODO: check
+ NOT-FOR-US: mcp-chrome-bridge
CVE-2026-102877 (Fider before 0.38.0 contains a server-side request forgery vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Fider
CVE-2026-102876 (SurrealDB before 3.3.0 contains an authorization bypass in HTTP sessio ...)
NOT-FOR-US: SurrealDB
CVE-2026-102875 (VLC media player before 3.0.24 contains a path traversal vulnerability ...)
@@ -1262,31 +1262,31 @@ CVE-2026-102875 (VLC media player before 3.0.24 contains a path traversal vulner
NOTE: https://code.videolan.org/videolan/vlc/-/commit/59934edbd03c6c1147d75d6c91e96633b710ec31 (3.0.24-rc1)
NOTE: https://code.videolan.org/videolan/vlc/-/commit/8d43e99c2c01d9aab3ecad00e7a102806262b06b (3.0.24-rc1)
CVE-2026-102874 (A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the ...)
- TODO: check
+ NOT-FOR-US: HKUDS AnyTool
CVE-2026-102847 (A flaw has been found in gedelumbung HospitalManagement up to c2d45543 ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102846 (A vulnerability was detected in gedelumbung HospitalManagement up to c ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102845 (A security vulnerability has been detected in gedelumbung HospitalMana ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102844 (A weakness has been identified in gedelumbung HospitalManagement up to ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102843 (A security flaw has been discovered in gedelumbung HospitalManagement ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102842 (A vulnerability was identified in gedelumbung HospitalManagement up to ...)
- TODO: check
+ NOT-FOR-US: gedelumbung HospitalManagement
CVE-2026-102805 (A flaw has been found in Nothings stb up to 1.16. This affects the fun ...)
TODO: check
CVE-2026-102804 (A vulnerability was detected in Nothings stb up to 2c980bb59875b0d3214 ...)
TODO: check
CVE-2026-102794 (A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This iss ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102793 (A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102792 (A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affec ...)
- TODO: check
+ NOT-FOR-US: Ziroom ZHOME A0101
CVE-2026-102771 (A security vulnerability has been detected in Naichen ThinkCMF up to 8 ...)
- TODO: check
+ NOT-FOR-US: Naichen ThinkCMF
CVE-2026-102621 (A vulnerability was identified in Freedesktop Poppler up to 26.08.0. A ...)
- poppler <unfixed>
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763
@@ -1310,31 +1310,31 @@ CVE-2026-102253 (iperf3 versions prior to 3.22 contains a denial of service vuln
NOTE: https://github.com/esnet/iperf/commit/a25378f8cbbaa7b3db5674ca3dcc19658ae65da3 (3.22)
NOTE: https://github.com/esnet/iperf/releases/tag/3.22
CVE-2026-102252 (A path traversal vulnerability (CWE-22) in the embedded VMDK filesyste ...)
- TODO: check
+ NOT-FOR-US: Google OSV-SCALIBR
CVE-2026-100299 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, the devi ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100298 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, two user ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100297 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, an unaut ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100296 (In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100295 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, an inter ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100294 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, the firm ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100293 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, both the ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100292 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, a hidden ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100291 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, several ...)
- TODO: check
+ NOT-FOR-US: Anjvision firmware
CVE-2026-100143 (The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 d ...)
NOT-FOR-US: WordPress plugin
CVE-2024-31027 (Cross Site Scripting vulnerability in Greek Universities Network (GUne ...)
- TODO: check
+ NOT-FOR-US: Greek Universities Network (GUnet) Open eClass Platform
CVE-2024-31026 (An issue in Greek Universities Network (GUnet) Open eClass Platform v. ...)
- TODO: check
+ NOT-FOR-US: Greek Universities Network (GUnet) Open eClass Platform
CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via attacker-controlled reverse-DNS hostname in auto-hosts parsing]
- sshuttle 2.0.0-1
NOTE: https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
@@ -2838,11 +2838,11 @@ CVE-2026-100392 (InvoicePlane is a self-hosted open source application for manag
CVE-2026-100371 (InvoicePlane is a self-hosted open source application for managing inv ...)
NOT-FOR-US: InvoicePlane
CVE-2026-100370 (DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to vers ...)
- TODO: check
+ NOT-FOR-US: DOMSanitizer
CVE-2024-58386 (ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vuln ...)
TODO: check
CVE-2024-42002 (A code injection vulnerability has been discovered in the Robot Operat ...)
- TODO: check
+ NOT-FOR-US: Operating System 2 (ROS 2) 'ros2topic' CLI tool
CVE-2026-96415 (Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 ...)
- wireshark <unfixed>
NOTE: https://www.wireshark.org/security/wnpa-sec-2026-110
@@ -10918,7 +10918,7 @@ CVE-2026-87902 (An unauthenticated attacker can make `get_page_template()` page-
CVE-2026-87119 (Authentication Bypass by Capture-replay in ZenHive mpp allows an attac ...)
NOT-FOR-US: ZenHive mpp
CVE-2026-86698 (Insufficient Session Expiration vulnerability in OAuth token issuance ...)
- TODO: check
+ NOT-FOR-US: hexpm (server side)
CVE-2026-86062 (LightRAG provides simple and fast retrieval-augmented generation. Prio ...)
NOT-FOR-US: LightRAG
CVE-2026-86059 (Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior t ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/172b3c40d3d8af2a1b607d32b587d946492d7fbd
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/172b3c40d3d8af2a1b607d32b587d946492d7fbd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/e44a28a7/attachment.htm>
More information about the debian-security-tracker-commits
mailing list