[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 08:58:19 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a4cb4024 by Salvatore Bonaccorso at 2026-10-02T09:58:06+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -83,75 +83,75 @@ CVE-2026-64893 (- Cleartext Transmission of Sensitive Information vulnerability
CVE-2026-64892 (- Exposure of Sensitive Information vulnerability in Johnson Controls ...)
NOT-FOR-US: Johnson Controls
CVE-2026-63569 (Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 tw ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63568 (Allocation of resources without limits or throttling in the CMP/CRMF p ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63567 (Observable discrepancy in IesEngine.DecryptBlock in Legion of the Boun ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-63566 (Memory allocation with excessive size value in the DTLS handshake reas ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-56662 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-56661 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-56660 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-55396 (Cleartext transmission without a cryptographic integrity check in oper ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55395 (Hardcoded passwords in the access control in Teledyne FLIR Aware2 vers ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55394 (Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 vers ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55393 (Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 ver ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-55252 (OpenRun is an open-source, self-hosted GitOps platform for deploying w ...)
- TODO: check
+ NOT-FOR-US: OpenRun
CVE-2026-55251 (NetBox Device Type Library is a collection of community-sourced device ...)
- TODO: check
+ NOT-FOR-US: NetBox Device Type Library
CVE-2026-54049 (Sakai is a Collaboration and Learning Environment (CLE). From versions ...)
- TODO: check
+ NOT-FOR-US: Sakai
CVE-2026-53964 (Document Merge Service is a document template merge service providing ...)
- TODO: check
+ NOT-FOR-US: Document Merge Service
CVE-2026-53953 (GetSimple CMS is a content management system (CMS), and GetSimple CMS ...)
- TODO: check
+ NOT-FOR-US: GetSimple CMS
CVE-2026-51897 (RAGFlow 0.24.0 contains improper access control in get_dataset (api/ap ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51896 (infiniflow ragflow 0.25.3 contains improper access control in resume ( ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51895 (Ragflow 0.24.0 and prior contains improper access control in update_me ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51894 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51893 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51892 (infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control vi ...)
- TODO: check
+ NOT-FOR-US: RAGFlow
CVE-2026-51888 (langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The i ...)
- TODO: check
+ NOT-FOR-US: langflow-ai langflow
CVE-2026-51886 (langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact ...)
- TODO: check
+ NOT-FOR-US: langflow-ai langflow
CVE-2026-51884 (The /knowledge_base/upload_temp_docs temporary document upload endpoin ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51883 (The knowledge base creation and document upload interfaces in Langchai ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51882 (The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Ch ...)
- TODO: check
+ NOT-FOR-US: Langchain Chatchat
CVE-2026-51881 (deeptutor 1.4.0 contains code injection in ExecTool.execute. Through t ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51880 (deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execut ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51879 (deeptutor 1.4.0 contains an authorization bypass through a user-contro ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51878 (deeptutor 1.4.0 contains an authorization bypass through a user-contro ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51876 (DeepTutor 1.4.0 contains an authorization bypass vulnerability in the ...)
- TODO: check
+ NOT-FOR-US: deeptutor
CVE-2026-51875 (In Devika v1.0, the Feature Agent save_code_to_project function contai ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-51874 (In Devika v1.0, the Patcher Agent save_code_to_project function contai ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-51873 (Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_cod ...)
- TODO: check
+ NOT-FOR-US: Devika
CVE-2026-34494 (- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series ...)
NOT-FOR-US: Johnson Controls
CVE-2026-34493 (- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS3 ...)
@@ -167,21 +167,21 @@ CVE-2026-1661 (The WP Mail Logging WordPress plugin before 1.17.0 does not prope
CVE-2026-19660 (The Divi Membership plugin for WordPress is vulnerable to Authenticati ...)
NOT-FOR-US: WordPress plugin
CVE-2026-18397 (This vulnerability enables unauthenticated remote code execution (RCE) ...)
- TODO: check
+ NOT-FOR-US: Thales SConnect
CVE-2026-16001 (Exposure of the message authentication key through the encryption keys ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-16000 (Missing cryptographic step in the DSTU 7624 CCM mode implementation (K ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-15999 (Improper validation of integrity check value in the AES-CCM implementa ...)
- TODO: check
+ NOT-FOR-US: Bouncy Castle bc-csharp
CVE-2026-15897 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15896 (The Super Forms \u2013 Drag & Drop Form Builder plugin for WordPress i ...)
NOT-FOR-US: WordPress plugin
CVE-2026-14984 (Cleartext transmission in the primary control endpoints of Teledyne FL ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-14983 (Missing authentication in the web interface in Teledyne FLIR Aware2 ve ...)
- TODO: check
+ NOT-FOR-US: Teledyne FLIR Aware2
CVE-2026-14378 (The DevKit Pro plugin for WordPress is vulnerable to Authentication By ...)
NOT-FOR-US: WordPress plugin
CVE-2026-13718 (The Tabs Responsive WordPress plugin through 2.5 does not sanitize th ...)
@@ -191,43 +191,43 @@ CVE-2026-13413 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin before
CVE-2026-10026 (The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104480 (Discord libdave before 1.2.0 did not reject an MLS Welcome message whe ...)
- TODO: check
+ NOT-FOR-US: Discord libdave
CVE-2026-104356 (PictShare before version 3.7.1 contains a weak randomness vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: PictShare
CVE-2026-104286 (An improper limitation of a pathname to a restricted directory ('path ...)
NOT-FOR-US: Fortinet
CVE-2026-104183 (stream-json is a micro-library of stream components for processing JSO ...)
- TODO: check
+ NOT-FOR-US: stream-json
CVE-2026-104182 (stream-json is a micro-library of stream components for processing JSO ...)
- TODO: check
+ NOT-FOR-US: stream-json
CVE-2026-104181 (Filament is a collection of full-stack components for accelerated Lara ...)
- TODO: check
+ NOT-FOR-US: Filament
CVE-2026-104123 (A vulnerability was detected in SourceCodester Online Reviewer Managem ...)
NOT-FOR-US: SourceCodester
CVE-2026-104120 (A security vulnerability has been detected in modelcontextprotocol mcp ...)
- TODO: check
+ NOT-FOR-US: modelcontextprotocol
CVE-2026-104054 (A security flaw has been discovered in calcom cal.diy up to 6.2.0. Thi ...)
- TODO: check
+ NOT-FOR-US: calcom cal.diy
CVE-2026-104053 (A vulnerability was identified in itsourcecode Pet Shop Management Sys ...)
NOT-FOR-US: itsourcecode System
CVE-2026-104052 (A vulnerability was determined in itsourcecode Pet Shop Management Sys ...)
NOT-FOR-US: itsourcecode System
CVE-2026-104051 (PictShare before 3.7.1 contains an information disclosure vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: PictShare
CVE-2026-104020 (Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0 ...)
NOT-FOR-US: Amazon
CVE-2026-104002 (A fail-open error handling issue within the data masking utility of Po ...)
NOT-FOR-US: Amazon
CVE-2026-103766 (ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerabili ...)
- TODO: check
+ NOT-FOR-US: ClipBucket
CVE-2026-103765 (Mooncake through 0.3.13.post1 contains a missing authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103764 (Mooncake transfer engine before 0.3.13 contains an untrusted pointer d ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103761 (Mooncake transfer engine through 0.3.13.post1 contains a memory exhaus ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103760 (Mooncake transfer engine through 0.3.13.post1 contains a denial of ser ...)
- TODO: check
+ NOT-FOR-US: Mooncake
CVE-2026-103484 (IVFFlat index build in pgvector before 0.8.7 allows a database user to ...)
TODO: check
CVE-2026-103098 (Transmission of a sensitive key in the URL over an unencrypted HTTP co ...)
@@ -237,19 +237,19 @@ CVE-2026-103097 (An API key is hardcoded and retrievable from the application pa
CVE-2026-103096 (API key is hardcoded and retrievable from the application package. Sin ...)
NOT-FOR-US: GeoVision
CVE-2026-102671 (The Joyland AI app accepts invalid SSL certificates in the invisible a ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102670 (Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102669 (Joyland AI app does not verify hostnames, allowing a malicious host to ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102668 (The Joyland AI app accepts any TLS certificates from any server withou ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102667 (Joyland AI app allows an attacker with shared network access to inject ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102666 (The Joyland AI app contains hard-coded credentials for the GeTui push ...)
- TODO: check
+ NOT-FOR-US: Joyland AI app
CVE-2026-102628 (The Cadmos LTI application hosted at cadmos.eummena.io had Laravel deb ...)
- TODO: check
+ NOT-FOR-US: Cadmos LTI application
CVE-2026-102565 (The BA Book Everything plugin for WordPress is vulnerable to Stored Cr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (p ...)
@@ -257,9 +257,9 @@ CVE-2026-102514 (Out-of-bounds Write (CWE-787) in the PEA archive extraction rou
CVE-2026-102370 (Kasa EC70 v4 and EC71 v4 do not logically disable the production debug ...)
NOT-FOR-US: TPLink
CVE-2026-100251 (Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TU ...)
- TODO: check
+ NOT-FOR-US: Wormhole.app
CVE-2025-71427 (Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal v ...)
- TODO: check
+ NOT-FOR-US: Office-PowerPoint-MCP-Server
CVE-2026-94603
- podman <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2542566
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a4cb402413b910745d5e514a0b870b61ad87f136
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a4cb402413b910745d5e514a0b870b61ad87f136
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/677f1b25/attachment.htm>
More information about the debian-security-tracker-commits
mailing list