[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 2 21:52:13 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3a0aea9f by Salvatore Bonaccorso at 2026-10-02T22:51:40+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -242,7 +242,7 @@ CVE-2026-80337 (Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Ch
 CVE-2026-80298 (Improper neutralization of special elements used in an SQL command ('S ...)
 	NOT-FOR-US: Sef AI Chatbot Platform
 CVE-2026-67989 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
-	TODO: check
+	NOT-FOR-US: crmne/ruby_llm
 CVE-2026-66859 (NULL Pointer Dereference, Use of Uninitialized Variable vulnerability  ...)
 	TODO: check
 CVE-2026-66858 (The protocol skip routine in several Apache Thrift bindings did not ap ...)
@@ -262,29 +262,29 @@ CVE-2026-64818
 CVE-2026-63772 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
 	TODO: check
 CVE-2026-63578 (Allocation of resources without limits in password-based private-key d ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63577 (Improper certificate validation in the directoryName name-constraint c ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63576 (Improper certificate validation in PkixNameConstraintValidator (Extrac ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63575 (Loop with unreachable exit condition in the PKCS#12 key derivation (Pk ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63574 (Memory allocation with excessive size value in the OpenPGP signature a ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63573 (Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63572 (Allocation of resources without limits in PKCS#12 keystore loading (Pk ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63571 (Improper verification of cryptographic signature in the attribute cert ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-63570 (Loop with unreachable exit condition in Pkcs12Store.GetCertificateChai ...)
-	TODO: check
+	NOT-FOR-US: Bouncy Castle bc-csharp
 CVE-2026-61374 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
 	TODO: check
 CVE-2026-61373 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
 	TODO: check
 CVE-2026-5782 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: TurkHotspot
 CVE-2026-59673 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
 	NOT-FOR-US: Repasat application
 CVE-2026-59672 (Cross-Site Scripting vulnerability in the Repasat application. Success ...)
@@ -318,31 +318,31 @@ CVE-2026-59659 (Cross-Site Scripting vulnerability in the Repasat application. S
 CVE-2026-59265 (A code execution issue in the Java integration in Apache OpenOffice v4 ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-51922 (agentscope v1.0.20 contains code injection in execute_shell_command (s ...)
-	TODO: check
+	NOT-FOR-US: agentscope
 CVE-2026-51918 (FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with ...)
-	TODO: check
+	NOT-FOR-US: FinRobot
 CVE-2026-51917 (FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_ ...)
-	TODO: check
+	NOT-FOR-US: FinRobot
 CVE-2026-51916 (TransformerOptimus SuperAGI v0.0.14 contains an incorrect access contr ...)
-	TODO: check
+	NOT-FOR-US: TransformerOptimus SuperAGI
 CVE-2026-51915 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access  ...)
-	TODO: check
+	NOT-FOR-US: TransformerOptimus SuperAGI
 CVE-2026-51914 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access  ...)
-	TODO: check
+	NOT-FOR-US: TransformerOptimus SuperAGI
 CVE-2026-51911 (vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_ ...)
-	TODO: check
+	NOT-FOR-US: vanna
 CVE-2026-51907 (In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image  ...)
-	TODO: check
+	NOT-FOR-US: TaskingAI
 CVE-2026-51906 (In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_ima ...)
-	TODO: check
+	NOT-FOR-US: TaskingAI
 CVE-2026-51904 (SuperAGI up to v0.0.14 contains an improper access control vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: SuperAGI
 CVE-2026-51901 (SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The a ...)
-	TODO: check
+	NOT-FOR-US: SuperAGI
 CVE-2026-51899 (In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/creat ...)
-	TODO: check
+	NOT-FOR-US: SuperAGI
 CVE-2026-51898 (sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExe ...)
-	TODO: check
+	NOT-FOR-US: sinaptik-ai pandas-ai
 CVE-2026-39717 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-39601 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
@@ -370,7 +370,7 @@ CVE-2026-17507 (In Bouncy Castle for Java before 1.86, the MLS implementation (o
 CVE-2026-12951 (The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-11795 (Observable discrepancy vulnerability in Softtr Informatics Trading Lim ...)
-	TODO: check
+	NOT-FOR-US: E-Commerce Pack
 CVE-2026-104914 (MISP contains an improper access control vulnerability in its attribut ...)
 	- misp <itp> (bug #1144317)
 CVE-2026-104912 (MISP contains an authorization flaw in its correlation handling during ...)
@@ -388,27 +388,27 @@ CVE-2026-104901 (MISP contains a cross-site scripting (XSS) vulnerability in the
 CVE-2026-104900 (MISP contains a stored cross-site scripting (XSS) vulnerability in the ...)
 	- misp <itp> (bug #1144317)
 CVE-2026-104861 (probe-image-size gets image dimensions without downloading the entire  ...)
-	TODO: check
+	NOT-FOR-US: probe-image-size
 CVE-2026-104859 (Nx is a monorepo solution for TypeScript and polyglot codebases. From  ...)
-	TODO: check
+	NOT-FOR-US: Nx
 CVE-2026-104855 (Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47 ...)
 	TODO: check
 CVE-2026-104854 (Nx is a monorepo solution for TypeScript and polyglot codebases. From  ...)
-	TODO: check
+	NOT-FOR-US: Nx
 CVE-2026-104853 (Nx is a monorepo solution for TypeScript and polyglot codebases. From  ...)
-	TODO: check
+	NOT-FOR-US: Nx
 CVE-2026-104851 (fsspec is a specification and Python implementation framework for file ...)
 	TODO: check
 CVE-2026-104849 (Tinypool is a minimal Node.js worker thread pool implementation. Prior ...)
-	TODO: check
+	NOT-FOR-US: Tinypool
 CVE-2026-104848 (Tinypool is a minimal Node.js worker thread pool implementation. Prior ...)
-	TODO: check
+	NOT-FOR-US: Tinypool
 CVE-2026-104847 (ProseMirror's view component renders and manages the editable browser  ...)
-	TODO: check
+	NOT-FOR-US: ProseMirror
 CVE-2026-104846 (Seroval facilitates JS value stringification, including complex struct ...)
-	TODO: check
+	NOT-FOR-US: Seroval
 CVE-2026-104845 (Seroval facilitates JS value stringification, including complex struct ...)
-	TODO: check
+	NOT-FOR-US: Seroval
 CVE-2026-104844 (PostCSS Selector Parser is a CSS selector parser that integrates with  ...)
 	TODO: check
 CVE-2026-104843 (uv is a Python package and project manager written in Rust. From 0.12. ...)
@@ -418,9 +418,9 @@ CVE-2026-104733 (User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04
 CVE-2026-104721 (Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (l ...)
 	TODO: check
 CVE-2026-104638 (A security vulnerability has been detected in onetwothreeneth Hospital ...)
-	TODO: check
+	NOT-FOR-US: onetwothreeneth HospitalManagementSystem
 CVE-2026-104637 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
-	TODO: check
+	NOT-FOR-US: onetwothreeneth HospitalManagementSystem
 CVE-2026-104625 (A security flaw has been discovered in CodeAstro Simple Loan Managemen ...)
 	NOT-FOR-US: CodeAstro
 CVE-2026-104614 (A vulnerability was identified in CodeAstro Simple Pharmacy Management ...)
@@ -434,7 +434,7 @@ CVE-2026-104611 (A vulnerability was detected in Tenda AC9 15.03.02.13. Affected
 CVE-2026-104610 (A security vulnerability has been detected in Tenda HG7, HG9 and HG10  ...)
 	NOT-FOR-US: Tenda
 CVE-2026-104609 (A weakness has been identified in onetwothreeneth HospitalManagementSy ...)
-	TODO: check
+	NOT-FOR-US: onetwothreeneth HospitalManagementSystem
 CVE-2026-104606 (A security flaw has been discovered in itsourcecode Online Admission S ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2026-104473 (YesWiki before 4.5.3 contains multiple reflected cross-site scripting  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a0aea9f7baa370c4e1d04c7a89063d667dfc46f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a0aea9f7baa370c4e1d04c7a89063d667dfc46f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/93b7af2c/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list