[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Fri Oct 2 23:53:52 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
21720834 by Moritz Muehlenhoff at 2026-10-03T00:53:31+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -551,41 +551,41 @@ CVE-2026-104439 (YesWiki before 4.6.7 contains a user enumeration vulnerability
 CVE-2026-104438 (YesWiki before 4.6.7 contains a missing authorization vulnerability in ...)
 	NOT-FOR-US: YesWiki
 CVE-2026-104437 (Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104436 (Zebra before 4.5.0 contains an uncontrolled resource consumption vulne ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104435 (Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 co ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104434 (ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 c ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104432 (Zebra before 6.3.0 contains an improper exceptional condition check in ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104431 (Zebra before 6.0.0 contains a denial of service vulnerability that all ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104430 (Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script sig ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104429 (Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mem ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104428 (The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash  ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104427 (Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104426 (Zebra before 6.1.0 contains an inefficient algorithmic complexity vuln ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104425 (ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vuln ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104424 (Zebra before 6.1.0 contains an incorrect calculation vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104423 (Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumptio ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104422 (The block sync download path in Zebra (zebrad) before 6.3.0 reads a bl ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104421 (Zebra before 6.2.1 contains an incomplete cleanup vulnerability that a ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104420 (Zebra before 6.3.0 contains a protection mechanism failure that allows ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104419 (Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the blo ...)
-	TODO: check
+	NOT-FOR-US: Zebra zcash
 CVE-2026-104418 (Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulne ...)
 	- ghost <itp> (bug #892150)
 CVE-2026-104417 (Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerabilit ...)
@@ -607,7 +607,7 @@ CVE-2026-104410 (SiYuan before 3.8.5 contains an information disclosure vulnerab
 CVE-2026-104403 (Authorization Bypass Through User-Controlled Key vulnerability in Thim ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104026 (In Sapling SCM prior to v0.2.20260929-102736, control characters were  ...)
-	TODO: check
+	NOT-FOR-US: Sapling SCM
 CVE-2026-103958 (Server-side request forgery in the tool server and remote agent connec ...)
 	NOT-FOR-US: Amazon
 CVE-2026-103957 (Server-side request forgery in the OAuth2 discovery handling in Loom f ...)
@@ -651,15 +651,15 @@ CVE-2026-103622 (Use after free in SVG in Google Chrome prior to 154.0.8037.97 a
 CVE-2026-103621 (Integer overflow in Compositing in Google Chrome prior to 154.0.8037.9 ...)
 	TODO: check
 CVE-2026-103604 (Inefficient algorithmic complexity in X.509 distinguished name string  ...)
-	TODO: check
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103603 (Memory allocation with excessive size value in the HSS/LMS signature c ...)
-	TODO: check
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103602 (Improper certificate validation in PkixNameConstraintValidator in Legi ...)
-	TODO: check
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103601 (Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7 ...)
-	TODO: check
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103600 (Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1Strea ...)
-	TODO: check
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API.    Before b ...)
 	TODO: check
 CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cr ...)
@@ -675,7 +675,7 @@ CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Sit
 CVE-2026-102731 (Memory allocation with excessive size value vulnerability in Apache Di ...)
 	TODO: check
 CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with the globa ...)
-	TODO: check
+	- limesurvey <itp> (bug #472802)
 CVE-2026-102002 (The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg E ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-101104 (The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an autho ...)
@@ -685,11 +685,11 @@ CVE-2026-100182 (The Download Monitor plugin for WordPress is vulnerable to Stor
 CVE-2026-100107 (The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2023-54405 (H3C CVM, the Cloud Virtualization Management component of the H3C CAS  ...)
-	TODO: check
+	NOT-FOR-US: H3C CVM,
 CVE-2020-37278 (Weaver e-Bridge contains an unauthenticated arbitrary file read vulner ...)
-	TODO: check
+	NOT-FOR-US: Weaver e-Bridge
 CVE-2014-125130 (CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for W ...)
-	TODO: check
+	NOT-FOR-US: google-mp3-audio-player
 CVE-2026-102966
 	- mediawiki 1:1.43.10+dfsg-1
 	NOTE: https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/4WXGIT3HVZ7QSELSPT6BX7XUFM6UMW2D/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/21720834c0928748316d88c144cf8330ece273ac

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/21720834c0928748316d88c144cf8330ece273ac
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/14d93796/attachment.htm>

More information about the debian-security-tracker-commits mailing list