[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 2 20:16:10 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ed87d949 by security tracker role at 2026-10-02T19:16:03+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,37 +1,37 @@
CVE-2026-97876 (A local attacker with control over GRUB's configuration can bypass loc ...)
TODO: check
CVE-2026-97663 (The Customer Reviews for WooCommerce plugin for WordPress is vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97652 (The WP Statistics \u2013 Simple, privacy-friendly Google Analytics alt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97641 (The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97637 (The JSON API Auth plugin for WordPress is vulnerable to Authentication ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97634 (The Event Tickets and Registration plugin for WordPress is vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97342 (The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97338 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97336 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96990 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-96940 (Weak authorization in Microsoft Exchange Server allows an authenticate ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96871 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96647 (The Listdom: AI-powered Business Directory with Classifieds Ads Listin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96613 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an autho ...)
TODO: check
CVE-2026-96578 (The GSpeech TTS \u2013 WordPress Text To Speech Plugin plugin for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96567 (The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96566 (The Newsletter \u2013 Send awesome emails from WordPress plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96294 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
TODO: check
CVE-2026-96292 (Inefficient regular expression complexity, Inefficient Algorithmic Com ...)
@@ -47,9 +47,9 @@ CVE-2026-96286 (Uncaught exception vulnerability in Apache Thrift Perl bindings.
CVE-2026-96277 (Uncaught exception, Improper Handling of Exceptional Conditions vulner ...)
TODO: check
CVE-2026-95817 (The DoFollow Case by Case plugin for WordPress is vulnerable to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95670 (The No External Links plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95662 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
TODO: check
CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font loader. ...)
@@ -97,35 +97,35 @@ CVE-2026-94634 (Allocation of resources without limits or throttling, Initializa
CVE-2026-94633 (Memory allocation with excessive size value, Improper handling of leng ...)
TODO: check
CVE-2026-94544 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94543 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94541 (The WPMobile.App \u2013 Android and iOS App Builder plugin for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94486 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94485 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94484 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94483 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94432 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94405 (Authorization Bypass Through User-Controlled Key vulnerability in Shah ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94180 (Authorization Bypass Through User-Controlled Key vulnerability in Mone ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93926 (Missing release of memory after effective lifetime, Missing release of ...)
TODO: check
CVE-2026-93925 (Stack-based buffer overflow, Incorrect bitwise shift of integer vulner ...)
TODO: check
CVE-2026-93880 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93875 (The JetAppointment plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93756 (The Smash Balloon Social Post Feed \u2013 Simple Social Feeds for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92834 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
TODO: check
CVE-2026-91784 (cjbassi/gotop is vulnerable to local argument injection via process te ...)
@@ -135,11 +135,11 @@ CVE-2026-91137 (Improper validation of specified quantity in input, Allocation o
CVE-2026-91135 (Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderT ...)
TODO: check
CVE-2026-90970 (GitLab has remediated a vulnerability in the GitLab AI Gateway compone ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-90440 (Uncaught exception, improper handling of exceptional conditions, impro ...)
TODO: check
CVE-2026-87920 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87117 (NULL pointer dereference vulnerability in Apache Thrift PHP bindings. ...)
TODO: check
CVE-2026-86537 (Uncaught exception, Loop with unreachable exit condition ('infinite lo ...)
@@ -149,15 +149,15 @@ CVE-2026-86536 (Improperly controlled modification of object prototype attribute
CVE-2026-86535 (Loop with unreachable exit condition ('infinite loop'), Improperly con ...)
TODO: check
CVE-2026-86326 (An improper verification of cryptographic signature vulnerability exis ...)
- TODO: check
+ NOT-FOR-US: Moxa
CVE-2026-86325 (A stack-based buffer overflow vulnerability exists in protocol gateway ...)
- TODO: check
+ NOT-FOR-US: Moxa
CVE-2026-85494 (Improper handling of length parameter inconsistency, Uncaught exceptio ...)
TODO: check
CVE-2026-85493 (Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME ...)
TODO: check
CVE-2026-85492 (The All in One SEO \u2013 AI SEO Plugin to Boost SEO Rankings & Traffi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85483 (Use of uninitialized resource, Return of wrong status code vulnerabili ...)
TODO: check
CVE-2026-85476 (Loop with unreachable exit condition ('infinite loop') vulnerability i ...)
@@ -265,7 +265,7 @@ CVE-2026-59660 (Cross-Site Scripting vulnerability in the Repasat application. S
CVE-2026-59659 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
TODO: check
CVE-2026-59265 (A code execution issue in the Java integration in Apache OpenOffice v4 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-51922 (agentscope v1.0.20 contains code injection in execute_shell_command (s ...)
TODO: check
CVE-2026-51918 (FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with ...)
@@ -293,23 +293,23 @@ CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents
CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExe ...)
TODO: check
CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39600 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in M ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39444 (Authorization Bypass Through User-Controlled Key vulnerability in Publ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39439 (Missing Authorization vulnerability in Kiera Howe WebSamurai websamura ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32585 (Missing Authorization vulnerability in airano Airano MCP Bridge airano ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32584 (Insertion of Sensitive Information Into Sent Data vulnerability in Chi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19856 (The All in One SEO WordPress plugin before 5.0.2.1 does not correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19652 (The Divi Membership plugin for WordPress is vulnerable to Privilege Es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18036 (In Bouncy Castle for Java before 1.86, NTRU reduced secret values with ...)
TODO: check
CVE-2026-17508 (In Bouncy Castle for Java before 1.86, several password-based key deri ...)
@@ -317,7 +317,7 @@ CVE-2026-17508 (In Bouncy Castle for Java before 1.86, several password-based ke
CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the MLS implementation (org.bou ...)
TODO: check
CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics Trading Lim ...)
TODO: check
CVE-2026-104914 (MISP contains an improper access control vulnerability in its attribut ...)
@@ -371,21 +371,21 @@ CVE-2026-104638 (A security vulnerability has been detected in onetwothreeneth H
CVE-2026-104637 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
TODO: check
CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan Managemen ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy Management ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104613 (A vulnerability was determined in CodeAstro Simple Pharmacy Management ...)
- TODO: check
+ NOT-FOR-US: CodeAstro
CVE-2026-104612 (A vulnerability was found in SourceCodester Student Result Management ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-104611 (A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9 and HG10 ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-104609 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
TODO: check
CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online Admission S ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site scripting ...)
TODO: check
CVE-2026-104472 (YesWiki before 4.6.7 contains a missing authorization vulnerability in ...)
@@ -511,17 +511,17 @@ CVE-2026-104412 (Ghost 0.5.0 before 6.64.0 does not correctly restrict staff rol
CVE-2026-104411 (Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting ...)
TODO: check
CVE-2026-104410 (SiYuan before 3.8.5 contains an information disclosure vulnerability t ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-104403 (Authorization Bypass Through User-Controlled Key vulnerability in Thim ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104026 (In Sapling SCM prior to v0.2.20260929-102736, control characters were ...)
TODO: check
CVE-2026-103958 (Server-side request forgery in the tool server and remote agent connec ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103957 (Server-side request forgery in the OAuth2 discovery handling in Loom f ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103956 (Missing authentication for critical function in the authentication dep ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-103885 (Asymmetric Resource Consumptionvulnerability in Apache Directory LDAP ...)
TODO: check
CVE-2026-103880 (Asymmetric Resource Consumptionvulnerability in Apache Directory LDAP ...)
@@ -531,9 +531,9 @@ CVE-2026-103878 (Cleartext transmission of sensitive informationvulnerability in
CVE-2026-103877 (Deserialization of Untrusted Data vulnerability in Apache Directory LD ...)
TODO: check
CVE-2026-103763 (SiYuan before v3.8.5 contains an information disclosure vulnerability ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-103762 (SiYuan before v3.8.5 contains a missing authorization vulnerability in ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-103648 (Path traversal in image-downloader 4.3.0 allows an attacker who can co ...)
TODO: check
CVE-2026-103631 (Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allo ...)
@@ -571,27 +571,27 @@ CVE-2026-103600 (Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, As
CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API. Before b ...)
TODO: check
CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102798 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102797 (Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group The ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102795 (Improper Access Control vulnerability in Apache Traffic Server. Thi ...)
TODO: check
CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102731 (Memory allocation with excessive size value vulnerability in Apache Di ...)
TODO: check
CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with the globa ...)
TODO: check
CVE-2026-102002 (The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101104 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an autho ...)
TODO: check
CVE-2026-100182 (The Download Monitor plugin for WordPress is vulnerable to Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100107 (The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-54405 (H3C CVM, the Cloud Virtualization Management component of the H3C CAS ...)
TODO: check
CVE-2020-37278 (Weaver e-Bridge contains an unauthenticated arbitrary file read vulner ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed87d949305eb327affef8f5a1ac8dcf9e2b3c1a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed87d949305eb327affef8f5a1ac8dcf9e2b3c1a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/51c174e3/attachment.htm>
More information about the debian-security-tracker-commits
mailing list