[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 11:47:56 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
32972a48 by Salvatore Bonaccorso at 2026-10-01T12:41:11+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -121,7 +121,7 @@ CVE-2026-51570 (modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traver
CVE-2026-51568 (modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal i ...)
NOT-FOR-US: modelscope Agentscope
CVE-2026-47096 (AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scrip ...)
- TODO: check
+ NOT-FOR-US: AJA HELO Plus firmware
CVE-2026-19253 (The Cache Enabler WordPress plugin before 1.8.17 does not validate a U ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14157 (Use of an Externally Controlled Format String in the ASUS Router modul ...)
@@ -133,17 +133,17 @@ CVE-2026-12241 (The Advanced Woo Labels \u2013 Product Labels & Badges for WooCo
CVE-2026-103641 (A flaw was found in GEGL. The Radiance HDR loader reads past the end o ...)
TODO: check
CVE-2026-103592 (simple-php-router through 5.4.1.7 contains an IP restriction bypass vu ...)
- TODO: check
+ NOT-FOR-US: simple-php-router
CVE-2026-103591 (DeepWiki-Open through commit d92819a contains an unauthenticated arbit ...)
- TODO: check
+ NOT-FOR-US: DeepWiki-Open
CVE-2026-103590 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103589 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103588 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103587 (QloApps through 1.7.0 contains a reflected cross-site scripting vulner ...)
- TODO: check
+ NOT-FOR-US: QloApps
CVE-2026-103585 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
TODO: check
CVE-2026-103584 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
@@ -151,33 +151,33 @@ CVE-2026-103584 (Improper neutralization of Script-Related HTML tags in a web pa
CVE-2026-103548 (Improperly stored passwords in the config file in Itron MV-90 xi 3.0 a ...)
NOT-FOR-US: Palo Alto Networks
CVE-2026-103547 (In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, d ...)
- TODO: check
+ NOT-FOR-US: ldapd in OpenBSD
CVE-2026-103544 (A vulnerability was found in datadrivenconstruction OpenConstructionER ...)
- TODO: check
+ NOT-FOR-US: OpenConstructionERP
CVE-2026-103543 (A vulnerability has been found in itsourcecode Leave Management System ...)
NOT-FOR-US: itsourcecode System
CVE-2026-103542 (A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacte ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103541 (A vulnerability was detected in formtools.org Form Tools up to 3.1.1. ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103540 (A security vulnerability has been detected in formtools.org Form Tools ...)
- TODO: check
+ NOT-FOR-US: Form Tools
CVE-2026-103539 (A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This aff ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103538 (A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Aff ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103536 (A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected ...)
- TODO: check
+ NOT-FOR-US: ZongXR SuperMarket
CVE-2026-103534 (A vulnerability was determined in David-Crty databasement up to 1.7.1. ...)
- TODO: check
+ NOT-FOR-US: David-Crty databasement
CVE-2026-103533 (A vulnerability was found in David-Crty databasement up to 1.7.1. This ...)
- TODO: check
+ NOT-FOR-US: David-Crty databasement
CVE-2026-103532 (A vulnerability has been found in immich-app Immich up to 2.7.5. This ...)
- TODO: check
+ NOT-FOR-US: immich-app Immich
CVE-2026-103531 (A flaw has been found in OpenSC up to 0.27.1. The impacted element is ...)
TODO: check
CVE-2026-103530 (A vulnerability was detected in decolua 9Router up to 0.5.55. The affe ...)
- TODO: check
+ NOT-FOR-US: decolua 9Router
CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to 4.4.1. This a ...)
TODO: check
CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
@@ -234,137 +234,137 @@ CVE-2026-102993 (pypdf is a free and open-source pure-python PDF library. Prior
NOTE: https://github.com/py-pdf/pypdf/pull/4047
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/89db7c4fe9315ecc964bfdf05a4e8c4b94175163 (6.17.0)
CVE-2026-102992 (piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2 ...)
- TODO: check
+ NOT-FOR-US: piscina
CVE-2026-102991 (Mako is a template library written in Python. Prior to 1.4.2, on Windo ...)
TODO: check
CVE-2026-102990 (basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() ...)
TODO: check
CVE-2026-102150 (A function in the Kiteworks Advanced Forms component was reachable wit ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102149 (Kiteworks Email Protection Gateway did not sufficiently restrict which ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102147 (A stored cross-site scripting (XSS) weakness in Kiteworks Core could a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102146 (An authenticated Email Protection Gateway administrator holding only l ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102145 (An authenticated administrator could cause the server to issue request ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102144 (A resource exhaustion vulnerability in Kiteworks Email Protection Gate ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102143 (An unauthenticated attacker could cause a file with attacker-controlle ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102142 (A system notification template on the Kiteworks appliance was rendered ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102141 (Two Kiteworks Core cluster-management operations did not validate file ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102140 (An authenticated administrator could initiate an administrative import ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102139 (An authorization check in the large file exchange feature of Kiteworks ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102138 (An authenticated administrator on a node with an optional, separately ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102137 (An authenticated administrator could bypass the content validation app ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102136 (In multi-node deployments, an attacker who had already obtained code e ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102135 (On a Kiteworks Email Protection Gateway cluster with database replicat ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102134 (Kiteworks Core did not apply its gateway-level API security controls t ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102133 (An optional, separately licensed repository-connector feature in Kitew ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102132 (An administrative import function in Kiteworks Core did not verify tha ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102131 (Kiteworks Email Protection Gateway rejected certain configuration sett ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102130 (Kiteworks Email Protection Gateway did not sufficiently validate the c ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102129 (A user-provisioning interface in Kiteworks Core did not verify that th ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102128 (An identity-verification weakness in Kiteworks Email Protection Gatewa ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102127 (An XML parser used by Kiteworks Email Protection Gateway did not restr ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102126 (A stored cross-site scripting (XSS) weakness in Kiteworks Core could a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102125 (The sandbox that isolates document conversion on a Kiteworks appliance ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102124 (A Kiteworks appliance setup interface did not enforce authentication o ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102123 (A Kiteworks appliance setup interface did not confine a user-supplied ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102122 (Kiteworks did not correctly enforce which roles a shared folder's mana ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102121 (A form-rendering interface in the Advanced Forms component is reachabl ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102120 (A privilege escalation vulnerability in Kiteworks could have allowed a ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102119 (A path traversal weakness in an optional, non-default administrative f ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102118 (A local privilege escalation vulnerability in Kiteworks could have all ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102117 (On deployments where the remote-support capability is licensed and ena ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102116 (-A weakness could have allowed an authenticated Kiteworks Email Protec ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102115 (Kiteworks Core did not correctly validate a parameter submitted to the ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102114 (A command injection vulnerability in Kiteworks could allow a high-priv ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102113 (A privilege escalation vulnerability in Kiteworks could allow an attac ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102112 (A privilege escalation vulnerability in Kiteworks could allow an attac ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102111 (Kiteworks did not enforce the maximum permitted value for a configurab ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102110 (An endpoint used during initial appliance setup did not require authen ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102109 (A SQL injection vulnerability existed in Kiteworks Secure Data Forms, ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102108 (An authenticated administrator of Kiteworks Email Protection Gateway c ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102107 (Kiteworks Core contains a business logic flaw in a Kiteworks file-requ ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102106 (Improper authentication in a Kiteworks Email Protection Gateway admini ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102105 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102104 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102103 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102102 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102101 (Kiteworks Core before version 9.5.0 is vulnerable to Deserialization o ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102100 (Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102099 (Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Wr ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102098 (Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102097 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102096 (Kiteworks Core before version 9.5.0 is vulnerable to OS Command Inject ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102095 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102094 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102093 (Kiteworks Core before version 9.5.0 is vulnerable to Improper Privileg ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102092 (Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102091 (Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Serv ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102090 (Kiteworks Core before version 9.5.1 is vulnerable to Content Injection ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-102089 (Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable ...)
- TODO: check
+ NOT-FOR-US: Kiteworks
CVE-2026-101887 (BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerabil ...)
TODO: check
CVE-2026-101885 (ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain ...)
- TODO: check
+ NOT-FOR-US: ZeroClaw
CVE-2026-101884 (OpenClaw Windows Node before 2026.7.1 contains an incomplete environme ...)
NOT-FOR-US: OpenClaw
CVE-2026-101883 (OpenClaw Windows Node through 2026.9.4 contains a server-side request ...)
@@ -382,13 +382,13 @@ CVE-2026-101148 (The BackupSheep WordPress Backup Plugin WordPress plugin throug
CVE-2026-101147 (The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Feat ...)
NOT-FOR-US: WordPress plugin
CVE-2025-41753 (The object name of a dynamically created BACnet File Object is interpr ...)
- TODO: check
+ NOT-FOR-US: WAGO
CVE-2024-58387 (Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability ...)
- TODO: check
+ NOT-FOR-US: Inspur Haiyue HCM Cloud
CVE-2023-54403 (Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vul ...)
- TODO: check
+ NOT-FOR-US: Yonyou U8 CRM
CVE-2023-54402 (iDocView contains a server-side request forgery vulnerability in its / ...)
- TODO: check
+ NOT-FOR-US: iDocView
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules]
- modsecurity <unfixed>
- modsecurity-apache <unfixed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32972a4843107df94a2020d137e0588160189b11
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32972a4843107df94a2020d137e0588160189b11
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/bab08ac0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list