[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 08:14:37 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ac263aa0 by security tracker role at 2026-10-02T07:14:31+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,87 +1,87 @@
CVE-2026-97318 (The Giveaways and Contests by RafflePress WordPress plugin before 1.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97317 (The Giveaways and Contests by RafflePress WordPress plugin before 1.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97219 (The MStore API WordPress plugin before 4.22.1 does not restrict which ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96780 (figlet.js is a FIG driver written in JavaScript that aims to implement ...)
TODO: check
CVE-2026-94298 (The BuildKit WordPress plugin before 1.0.29 does not properly sanitis ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93832 (A component of one of the Motorola system applications was exported wi ...)
- TODO: check
+ NOT-FOR-US: Lenovo
CVE-2026-93698 (Insufficient validation allows arbitrary commands to be executed via t ...)
TODO: check
CVE-2026-93697 (There is a stored XSS vulnerability allowing arbitrary code execution ...)
TODO: check
CVE-2026-93367 (The Visitors Traffic Real Time Statistics Pro plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93029 (There is a stored XSS vulnerability allowing arbitrary code execution ...)
TODO: check
CVE-2026-92924 (The Unlimited Elements for Elementor WordPress plugin before 2.0.21 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92820 (The Ninja Forms - File Uploads plugin for WordPress is vulnerable to a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92174 (The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Lo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91828 (The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91023 (The Motors WordPress plugin before 1.4.124 does not properly verify t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91022 (The Motors WordPress plugin before 1.4.124 does not sanitise and esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91020 (The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90988 (The Request a Quote WordPress plugin through 2.5.6 does not perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90987 (The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90952 (The WP Edit Password Protected WordPress plugin before 2.0.7 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90438 (The Ninja Forms \u2013 The Contact Form Builder That Grows With You pl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85016 (The Unlimited Elements for Elementor WordPress plugin before 2.0.21 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85005 (The Popup Maker WP WordPress plugin through 1.4.5 does not perform aut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85004 (The Popup Maker WordPress plugin through 1.4.5 does not perform a cap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84925 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84740 (The Events Calendar WordPress plugin before 6.17.5.1 does not validate ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82358 (RT-Labs AB C-Open CANopen contains a write protection bypass in the SD ...)
TODO: check
CVE-2026-82357 (RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the L ...)
TODO: check
CVE-2026-81740 (The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verif ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-79618 (The WP User Frontend WordPress plugin before 4.3.12 does not enforce i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78471 (The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-71542 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
TODO: check
CVE-2026-71454 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71453 (- External Control of File Name or Path vulnerability in Johnson Contr ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71452 (- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 a ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71451 (- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 a ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71449 (: Use of Hard-coded Cryptographic Key vulnerability in Johnson Control ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71448 (: Insecure Default Initialization of Resource vulnerability in Johnson ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71426 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
TODO: check
CVE-2026-70650 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
TODO: check
CVE-2026-64893 (- Cleartext Transmission of Sensitive Information vulnerability in Joh ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-64892 (- Exposure of Sensitive Information vulnerability in Johnson Controls ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-63569 (Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 tw ...)
TODO: check
CVE-2026-63568 (Allocation of resources without limits or throttling in the CMP/CRMF p ...)
@@ -153,19 +153,19 @@ CVE-2026-51874 (In Devika v1.0, the Patcher Agent save_code_to_project function
CVE-2026-51873 (Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_cod ...)
TODO: check
CVE-2026-34494 (- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-34493 (- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS3 ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-27874 (: Use of Hard-coded Credentials vulnerability in Johnson Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-27873 (- Use of Hard-coded Credentials vulnerability in Johnson Controls Easy ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-21140 (Improper access control in ManagedProvisioning prior to SMR Sep-2026 R ...)
- TODO: check
+ NOT-FOR-US: Samsung Mobile
CVE-2026-1661 (The WP Mail Logging WordPress plugin before 1.17.0 does not properly r ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19660 (The Divi Membership plugin for WordPress is vulnerable to Authenticati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18397 (This vulnerability enables unauthenticated remote code execution (RCE) ...)
TODO: check
CVE-2026-16001 (Exposure of the message authentication key through the encryption keys ...)
@@ -175,27 +175,27 @@ CVE-2026-16000 (Missing cryptographic step in the DSTU 7624 CCM mode implementat
CVE-2026-15999 (Improper validation of integrity check value in the AES-CCM implementa ...)
TODO: check
CVE-2026-15897 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15896 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14984 (Cleartext transmission in the primary control endpoints of Teledyne FL ...)
TODO: check
CVE-2026-14983 (Missing authentication in the web interface in Teledyne FLIR Aware2 ve ...)
TODO: check
CVE-2026-14378 (The DevKit Pro plugin for WordPress is vulnerable to Authentication By ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13718 (The Tabs Responsive WordPress plugin through 2.5 does not sanitize th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13413 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin before 4.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10026 (The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104480 (Discord libdave before 1.2.0 did not reject an MLS Welcome message whe ...)
TODO: check
CVE-2026-104356 (PictShare before version 3.7.1 contains a weak randomness vulnerabilit ...)
TODO: check
CVE-2026-104286 (An improper limitation of a pathname to a restricted directory ('path ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-104183 (stream-json is a micro-library of stream components for processing JSO ...)
TODO: check
CVE-2026-104182 (stream-json is a micro-library of stream components for processing JSO ...)
@@ -203,21 +203,21 @@ CVE-2026-104182 (stream-json is a micro-library of stream components for process
CVE-2026-104181 (Filament is a collection of full-stack components for accelerated Lara ...)
TODO: check
CVE-2026-104123 (A vulnerability was detected in SourceCodester Online Reviewer Managem ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-104120 (A security vulnerability has been detected in modelcontextprotocol mcp ...)
TODO: check
CVE-2026-104054 (A security flaw has been discovered in calcom cal.diy up to 6.2.0. Thi ...)
TODO: check
CVE-2026-104053 (A vulnerability was identified in itsourcecode Pet Shop Management Sys ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104052 (A vulnerability was determined in itsourcecode Pet Shop Management Sys ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104051 (PictShare before 3.7.1 contains an information disclosure vulnerabilit ...)
TODO: check
CVE-2026-104020 (Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0 ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-104002 (A fail-open error handling issue within the data masking utility of Po ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103766 (ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerabili ...)
TODO: check
CVE-2026-103765 (Mooncake through 0.3.13.post1 contains a missing authentication vulner ...)
@@ -231,11 +231,11 @@ CVE-2026-103760 (Mooncake transfer engine through 0.3.13.post1 contains a denial
CVE-2026-103484 (IVFFlat index build in pgvector before 0.8.7 allows a database user to ...)
TODO: check
CVE-2026-103098 (Transmission of a sensitive key in the URL over an unencrypted HTTP co ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-103097 (An API key is hardcoded and retrievable from the application package. ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-103096 (API key is hardcoded and retrievable from the application package. Sin ...)
- TODO: check
+ NOT-FOR-US: GeoVision
CVE-2026-102671 (The Joyland AI app accepts invalid SSL certificates in the invisible a ...)
TODO: check
CVE-2026-102670 (Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ ...)
@@ -251,11 +251,11 @@ CVE-2026-102666 (The Joyland AI app contains hard-coded credentials for the GeTu
CVE-2026-102628 (The Cadmos LTI application hosted at cadmos.eummena.io had Laravel deb ...)
TODO: check
CVE-2026-102565 (The BA Book Everything plugin for WordPress is vulnerable to Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (p ...)
TODO: check
CVE-2026-102370 (Kasa EC70 v4 and EC71 v4 do not logically disable the production debug ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-100251 (Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TU ...)
TODO: check
CVE-2025-71427 (Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal v ...)
@@ -349,7 +349,7 @@ CVE-2026-89424 (The Duplicate Post plugin for WordPress is vulnerable to Stored
CVE-2026-89047 (The Social Media Share Buttons & Social Sharing Icons plugin for WordP ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88789 (Improper Restriction of XML External Entity Reference in the XSLT supp ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85235 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84682 (A command injection vulnerability exists in the TDDPv2 service (/usr/b ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac263aa00900f6c7ed46dbec1a0a1223e96a1fb6
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac263aa00900f6c7ed46dbec1a0a1223e96a1fb6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/ba911080/attachment.htm>
More information about the debian-security-tracker-commits
mailing list