[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Thu Oct 1 21:03:42 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ae393f44 by Salvatore Bonaccorso at 2026-10-01T22:02:01+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -188,17 +188,17 @@ CVE-2026-56599 (HCL BigFix Service Management is affected by an Insecure Cookie
 CVE-2026-56589 (HCL BigFix Service Management is affected by a Stored Cross-Site Scrip ...)
 	NOT-FOR-US: HCL
 CVE-2026-56098 (A flaw was found in rubygem-katello. The RegistryProxiesController in  ...)
-	TODO: check
+	NOT-FOR-US: Katello
 CVE-2026-56097 (A flaw was found in rubygem-katello. An SQL injection vulnerability ex ...)
-	TODO: check
+	NOT-FOR-US: rubygem-katello
 CVE-2026-55232 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
-	TODO: check
+	NOT-FOR-US: Vvveb
 CVE-2026-55231 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
-	TODO: check
+	NOT-FOR-US: Vvveb
 CVE-2026-55230 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
-	TODO: check
+	NOT-FOR-US: Vvveb
 CVE-2026-55083 (DHIS2 is a flexible information system for data capture, management, v ...)
-	TODO: check
+	NOT-FOR-US: DHIS2
 CVE-2026-34190 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
 	NOT-FOR-US: Pandora FMS
 CVE-2026-34189 (Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized de ...)
@@ -230,7 +230,7 @@ CVE-2026-13043 (A missing authentication vulnerability in the Kernel Memory Acce
 CVE-2026-12627 (Fortra's Core Privileged Access Manager (BoKS) contains a stack-based  ...)
 	NOT-FOR-US: Fortra
 CVE-2026-12545 (A flaw was found in rubygem-hammer_cli. A command injection vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: rubygem-hammer_cli
 CVE-2026-12544 (A flaw was found in Foreman. The foreman-rake initialization logic in  ...)
 	TODO: check
 CVE-2026-12542 (A flaw was found in Foreman. The foreman-tail utility is vulnerable to ...)
@@ -242,13 +242,13 @@ CVE-2026-12540 (A flaw was found in Foreman. A command injection vulnerability e
 CVE-2026-12423 (A flaw was found in Foreman. The Red Hat Satellite /unattended/provisi ...)
 	TODO: check
 CVE-2026-12405 (A flaw was found in rubygem-foreman_remote_execution. A command inject ...)
-	TODO: check
+	NOT-FOR-US: rubygem-foreman_remote_execution
 CVE-2026-104059 (Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulne ...)
-	TODO: check
+	NOT-FOR-US: Lektor CMS
 CVE-2026-104058 (Podgrab contains a missing authentication vulnerability in which the / ...)
-	TODO: check
+	NOT-FOR-US: Podgrab
 CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service vulnerability ca ...)
-	TODO: check
+	NOT-FOR-US: Podgrab
 CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where discove ...)
 	TODO: check
 CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
@@ -256,17 +256,17 @@ CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists
 CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
 	TODO: check
 CVE-2026-103922 (Capacitor is a cross-platform native runtime for web applications. Fro ...)
-	TODO: check
+	NOT-FOR-US: Capacitor
 CVE-2026-103921 (GraphQL Tools provides utilities for building, stitching, and mocking  ...)
-	TODO: check
+	NOT-FOR-US: GraphQL Tools
 CVE-2026-103884 (A flaw was found in the X.509 client certificate authenticator of Keyc ...)
 	TODO: check
 CVE-2026-103858 (MISP contains an incomplete authorization check in the discussion post ...)
 	TODO: check
 CVE-2026-103758 (Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Obot
 CVE-2026-103757 (Budibase through 3.41.0 contains a server-side request forgery vulnera ...)
-	TODO: check
+	NOT-FOR-US: Budibase
 CVE-2026-103754 (A flaw was found in ansible-runner. The unstream_dir() function, which ...)
 	TODO: check
 CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.)
@@ -274,9 +274,9 @@ CVE-2026-103752 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 ve
 CVE-2026-103690 (A flaw has been found in itsourcecode Leave Management System 1.0. Thi ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. ...)
-	TODO: check
+	NOT-FOR-US: DOMSanitizer
 CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted ...)
-	TODO: check
+	NOT-FOR-US: DOMSanitizer
 CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can occur in th ...)
 	TODO: check
 CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit this vulnera ...)
@@ -390,9 +390,9 @@ CVE-2026-103267 (Ghost versions before 6.62.0 contain an authentication bypass v
 CVE-2026-103266 (Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote a ...)
 	TODO: check
 CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM command resul ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass vulnerab ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability in Static ...)
 	TODO: check
 CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accumulation ...)
@@ -432,7 +432,7 @@ CVE-2026-103246 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to val
 CVE-2026-103245 (n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40. ...)
 	NOT-FOR-US: n8n
 CVE-2026-103244 (ground-station versions before 0.8.0 contain an authentication bypass  ...)
-	TODO: check
+	NOT-FOR-US: ground-station
 CVE-2026-103082 (Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studi ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103068 (Subscriber Privilege Escalation in ByteCoreStack – MCP Connector ...)
@@ -464,11 +464,11 @@ CVE-2026-102294 (TP-Link TL-WR841N contains an authenticated OS command injectio
 CVE-2026-101925 (The bbp style pack plugin for WordPress is vulnerable to Stored Cross- ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-101890 (The Prime Mover plugin for WordPress before 2.2.1 contains a stored cr ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a path trav ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-101888 (The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before ...)
 	TODO: check
 CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in Photo Revi ...)
@@ -482,9 +482,9 @@ CVE-2026-100179 (The Calculated Fields Form \u2013 AI Form Builder for WordPress
 CVE-2025-31980 (HCL BigFix Service Management is affected by an Improper Input Validat ...)
 	NOT-FOR-US: HCL
 CVE-2024-58388 (Sharp (and Toshiba Tec rebranded) multifunction printers contain an un ...)
-	TODO: check
+	NOT-FOR-US: Sharp printers
 CVE-2023-54404 (Zod schema-validation library through 4.6.5 contains an uncontrolled r ...)
-	TODO: check
+	NOT-FOR-US: Zod
 CVE-2026-42356 (Deployment of wrong handler vulnerability in Apache HTTP Server allows ...)
 	- apache2 <unfixed>
 	NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2026-42356



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae393f444e4ca97e635e30b0614a005ecc6f1c4c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae393f444e4ca97e635e30b0614a005ecc6f1c4c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/7d307f0e/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list