[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 20:15:21 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7b827b4a by security tracker role at 2026-10-01T19:15:13+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,89 +1,89 @@
CVE-2026-9864 (Fortra BoKS Server Agent contains a predictable password generation vu ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-9032 (Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTT ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-97662 (An argument injection issue in the diff scan operation in AWS security ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-97661 (The Business Essentials for Contact Form 7 plugin for WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97297 (Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97284 (Contributor PHP Object Injection in Icegram <= 3.1.31 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97281 (Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97280 (Missing Authorization vulnerability in Mamunur Rashid Review Schema re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97277 (Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97273 (Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97269 (Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97268 (Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97260 (Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97258 (Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97251 (Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96813 (The Form Maker by 10Web \u2013 Mobile-Friendly Drag & Drop Contact For ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96659 (A flaw was found in Foreman. This vulnerability allows an authenticate ...)
TODO: check
CVE-2026-96658 (A flaw was found in Foreman. An authenticated attacker with low-level ...)
TODO: check
CVE-2026-96573 (The Appointment Hour Booking \u2013 Booking Calendar plugin for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96268 (The Awesome Support \u2013 WordPress HelpDesk & Support Plugin plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96256 (The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Block ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95687 (The WPC Shop as a Customer for WooCommerce plugin for WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95588 (Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95137
REJECTED
CVE-2026-94620 (Classroom 50 is a free and open-source tool for managing and grading p ...)
TODO: check
CVE-2026-94390 (Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94276 (Improper Authentication vulnerability in Apache APISIX. On a route us ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94269 (Use of Non-Canonical URL paths for authorization decisions vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94250 (Allocation of resources without limits or throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94220 (Cross-Site request forgery (CSRF) vulnerability in feishu-auth and din ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94212 (Improper verification of cryptographic signature vulnerability in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-93882 (The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92244 (The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92144 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90992 (The Redux Framework plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-8618 (A stack-based buffer overflow vulnerability exists in the TDDPv2 servi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-89427 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89424 (The Duplicate Post plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89047 (The Social Media Share Buttons & Social Sharing Icons plugin for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88789 (Improper Restriction of XML External Entity Reference in the XSLT supp ...)
TODO: check
CVE-2026-85235 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84682 (A command injection vulnerability exists in the TDDPv2 service (/usr/b ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-82806 (Exposure of data element to wrong session vulnerability in Apache APIS ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-7176 (CVE-2026-7176: the Help text and Title parameters in the endpoint /eve ...)
TODO: check
CVE-2026-7175 (CVE-2026-7175: the Business Name parameter in the /promoters/edit endp ...)
@@ -93,29 +93,29 @@ CVE-2026-7174 (CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entra
CVE-2026-7173 (CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Cro ...)
TODO: check
CVE-2026-79901 (In deployments using BoKS keytab management, affected versions of boks ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79900 (boks_ksllogsd accepts a checksum algorithm name in the MD field of an ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79899 (Fortra BoKS Manager contains an insecure temporary file vulnerability ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79898 (Fortra BoKS Manager contains a command injection vulnerability in crls ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-79896 (Fortra BoKS Manager contains an out-of-bounds read vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-78578 (Tapo C120 v1 and C200 v5 do not enforce authentication for do method H ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-78577 (Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboardi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-78249 (A path traversal vulnerability exists in the web management interface ...)
TODO: check
CVE-2026-78242 (Insertion of sensitive information into log file vulnerability in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77387 (geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point a ...)
TODO: check
CVE-2026-75957 (The Ultimate Multisite \u2013 WordPress Multisite SaaS & WaaS Platform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75786 (Unsanitized concatenation of the module parameter in the Grafana datas ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-73976 (djehuty is a research data repository system developed by 4TU.Research ...)
TODO: check
CVE-2026-73975 (djehuty is a research data repository system developed by 4TU.Research ...)
@@ -125,57 +125,57 @@ CVE-2026-68496 (The Smile parser in FasterXML jackson-dataformats-binary never i
CVE-2026-68495 (The CBOR parser in FasterXML jackson-dataformats-binary never invokes ...)
TODO: check
CVE-2026-67172 (HCL BigFix Service Management is affected by an Information Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67171 (HCL BigFix Service Management is affected by an Information Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67106 (HCL BigFix Service Management is affected by an Information Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67105 (HCL BigFix Service Management is affected by an Insecure Communication ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-67104 (HCL BigFix Service Management is affected by an Information Disclosure ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66253 (iControl is affected by a Session Timeout vulnerability, which could a ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66249 (iControl is affected by a Missing Secure Attribute vulnerability, whic ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66248 (iControl is affected by an Improper Error Handling vulnerability, whic ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66247 (iControl is affected by an insecure Cross-Origin Resource Sharing (COR ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66246 (iControl is affected by a Broken Access Control vulnerability, which c ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-64950 (Missing input validation and output encoding on the directory name par ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64949 (Incomplete extension blacklist in the File Manager module allows authe ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64948 (Missing authorization in module data retrieval allows unauthorized cro ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64947 (A chained CSRF bypass and unrestricted file upload vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-64946 (A chained CSRF and unrestricted SVG file upload vulnerability in the F ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-63724
REJECTED
CVE-2026-63721
REJECTED
CVE-2026-62073 (Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62071 (Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62063 (Missing Authorization vulnerability in Magepeople inc. WpTravelly tour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62061 (Authorization Bypass Through User-Controlled Key vulnerability in Meta ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62060 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62059 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62058 (Insertion of Sensitive Information Into Sent Data vulnerability in WPE ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-56599 (HCL BigFix Service Management is affected by an Insecure Cookie Attrib ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-56589 (HCL BigFix Service Management is affected by a Stored Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-56098 (A flaw was found in rubygem-katello. The RegistryProxiesController in ...)
TODO: check
CVE-2026-56097 (A flaw was found in rubygem-katello. An SQL injection vulnerability ex ...)
@@ -189,35 +189,35 @@ CVE-2026-55230 (Vvveb is a powerful and easy to use CMS with page builder to bui
CVE-2026-55083 (DHIS2 is a flexible information system for data capture, management, v ...)
TODO: check
CVE-2026-34190 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-34189 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
- TODO: check
+ NOT-FOR-US: Pandora FMS
CVE-2026-27872 (- Improper Privilege Management vulnerability in Johnson Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-21833 (HCL AION is affected by a vulnerability in which the Content-Security- ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19902 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19807 (The ByteCoreStack \u2013 MCP Connector for AI Tools plugin for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18734
REJECTED
CVE-2026-17053 (The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-15989 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15983 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15911 (Confluent Kafka Python client's HashiCorp Vault KMS integration could ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14995 (The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14316 (The revoked-key error path builds a human-readable failure reason usin ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-13043 (A missing authentication vulnerability in the Kernel Memory Access Dri ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-12627 (Fortra's Core Privileged Access Manager (BoKS) contains a stack-based ...)
- TODO: check
+ NOT-FOR-US: Fortra
CVE-2026-12545 (A flaw was found in rubygem-hammer_cli. A command injection vulnerabil ...)
TODO: check
CVE-2026-12544 (A flaw was found in Foreman. The foreman-rake initialization logic in ...)
@@ -241,7 +241,7 @@ CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service vulnerabi
CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where discove ...)
TODO: check
CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
- TODO: check
+ NOT-FOR-US: WindRiver
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
TODO: check
CVE-2026-103922 (Capacitor is a cross-platform native runtime for web applications. Fro ...)
@@ -259,9 +259,9 @@ CVE-2026-103757 (Budibase through 3.41.0 contains a server-side request forgery
CVE-2026-103754 (A flaw was found in ansible-runner. The unstream_dir() function, which ...)
TODO: check
CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103690 (A flaw has been found in itsourcecode Leave Management System 1.0. Thi ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. ...)
TODO: check
CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted ...)
@@ -285,47 +285,47 @@ CVE-2026-103655 (MISP contains a vulnerability in its two-factor authentication
CVE-2026-103651 (MISP contains a vulnerability in its one-time password (OTP) authentic ...)
TODO: check
CVE-2026-103505 (Improper neutralization of argument delimiters in the volume handling ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103497 (In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the Gi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103496 (In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103495 (In JetBrains YouTrack before 2026.2.19422 missing authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103494 (In JetBrains YouTrack before 2026.2.19422 privilege escalation was pos ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103493 (In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and L ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103492 (In JetBrains YouTrack before 2026.2.19422 doS attack was possible via ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103491 (In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103490 (In JetBrains YouTrack before 2026.2.19422 privilege escalation was pos ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103489 (In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS comman ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103488 (In JetBrains YouTrack before 2026.2.19422 missing authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-103431 (colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 termin ...)
TODO: check
CVE-2026-103353 (Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentFor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103347 (Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103345 (Insertion of Sensitive Information Into Sent Data vulnerability in Sha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103343 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103341 (Missing Authorization vulnerability in Unlimited Elements Unlimited El ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103340 (Missing Authorization vulnerability in Gemini Labs Site Reviews site-r ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103339 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103338 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103336 (Insertion of Sensitive Information Into Sent Data vulnerability in Sma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103292 (Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to san ...)
TODO: check
CVE-2026-103291 (Ghost versions from 3.20.2 before 6.51.0 contain a server-side request ...)
@@ -389,69 +389,69 @@ CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accum
CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query string fields ...)
TODO: check
CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approva ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103259 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103258 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescap ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103257 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103256 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credenti ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103255 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103254 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103253 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103252 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103251 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103250 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103249 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103248 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103247 (n8n versions before 1.123.80 contain a credential tampering vulnerabil ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103246 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate c ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103245 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-103244 (ground-station versions before 0.8.0 contain an authentication bypass ...)
TODO: check
CVE-2026-103082 (Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103068 (Subscriber Privilege Escalation in ByteCoreStack – MCP Connector ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103067 (Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103064 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103063 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103004 (Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-102394 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102390 (Missing Authorization vulnerability in VillaTheme AFFI \u2013 Affiliat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102382 (Authorization Bypass Through User-Controlled Key vulnerability in Ahma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102381 (Missing Authorization vulnerability in Ahmad Majestic Support majestic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102379 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102378 (Unauthenticated Cross Site Scripting (XSS) in Parallax Section block < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102369 (Tapo C120 v1 and C200 V5 do not adequately protect login challenge dat ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-102294 (TP-Link TL-WR841N contains an authenticated OS command injection vulne ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101925 (The bbp style pack plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101890 (The Prime Mover plugin for WordPress before 2.2.1 contains a stored cr ...)
TODO: check
CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a path trav ...)
@@ -461,15 +461,15 @@ CVE-2026-101888 (The Prime Mover plugin for WordPress before 2.2.1 contains a Zi
CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before ...)
TODO: check
CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in Photo Revi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100514 (Unauthenticated Insecure Direct Object References (IDOR) in REST API L ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100184 (The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100179 (The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input Validat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers contain an un ...)
TODO: check
CVE-2023-54404 (Zod schema-validation library through 4.6.5 contains an uncontrolled r ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b827b4a11335547fbae7321c9cda678a9cd8d92
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b827b4a11335547fbae7321c9cda678a9cd8d92
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/d3605d0b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list