[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0b20ca61 by Salvatore Bonaccorso at 2026-10-03T11:38:08+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -133,13 +133,13 @@ CVE-2026-18443 (The Smart Manager \u2013 Advanced WooCommerce Bulk Edit & Invent
 CVE-2026-15795 (The Responsive Plus \u2013 Elementor Templates & Starter Sites plugin  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-12392 (An information exposure vulnerability in Canonical MAAS prior to versi ...)
-	TODO: check
+	NOT-FOR-US: Canonical MAAS
 CVE-2026-11601 (The WPCafe \u2013 Restaurant Menu, Online Food Ordering & Table Bookin ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-11399 (The Helpdesk Support Ticket System for WooCommerce plugin for WordPres ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105090 (Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The surv ...)
-	TODO: check
+	NOT-FOR-US: Formbricks
 CVE-2026-105083 (ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vul ...)
 	- imagemagick <unfixed>
 	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j
@@ -148,27 +148,27 @@ CVE-2026-105083 (ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy byp
 	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/da6022b2efe6cce8a2fd8f9e51188a45a3b9d558 (6.9.13-57)
 	NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/402ebc5353e569234908962cbdf451531ff66a57 (6.9.13-57)
 CVE-2026-105080 (In ConvertX before 0.19.0, converters/calibre.ts does not block recipe ...)
-	TODO: check
+	NOT-FOR-US: ConvertX
 CVE-2026-105051 (Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor pr ...)
-	TODO: check
+	NOT-FOR-US: Denuvo Anti-Tamper
 CVE-2026-105050 (PeaZip before 11.3.0, in a non-default configuration, is vulnerable to ...)
 	- peazip <itp> (bug #1119684)
 CVE-2026-105049 (Zilliz Attu before 3.0.0 has a Playground feature that does not requir ...)
-	TODO: check
+	NOT-FOR-US: Zilliz Attu
 CVE-2026-105048 (The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxyi ...)
-	TODO: check
+	NOT-FOR-US: Zilliz Attu
 CVE-2026-105046 (Kentico Xperience 13 before 13.0.216 lacks object-level authorization  ...)
-	TODO: check
+	NOT-FOR-US: Kentico Xperience
 CVE-2026-105043 (MathWorks Simulink before R2026b, when showing a crafted .slx file, ca ...)
-	TODO: check
+	NOT-FOR-US: MathWorks Simulink
 CVE-2026-105030 (Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Kener
 CVE-2026-105029 (UVdesk support-center-bundle before 1.1.3.3 contains an insecure direc ...)
-	TODO: check
+	NOT-FOR-US: UVdesk support-center-bundle
 CVE-2026-104994 (Trivy before 0.71.0 allows directory traversal in Terraform filesystem ...)
 	TODO: check
 CVE-2026-104991 (Phproject before 1.8.7 contains a missing object-level authorization v ...)
-	TODO: check
+	NOT-FOR-US: Phproject
 CVE-2026-104988 (A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentic ...)
 	- dogtag-pki <removed>
 CVE-2026-104887
@@ -178,7 +178,7 @@ CVE-2026-104886
 CVE-2026-104874 (Multidict is an implementation of a multidict data structure. From 6.7 ...)
 	TODO: check
 CVE-2026-104873 (LangGraph Python SDK is used to connect to running LangGraph API serve ...)
-	TODO: check
+	NOT-FOR-US: LangGraph Python SDK
 CVE-2026-104872 (OpenTelemetry JavaScript Contrib provides instrumentation libraries fo ...)
 	TODO: check
 CVE-2026-104871 (The Angular SSR is a server-rise rendering tool for Angular applicatio ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b20ca61af8ab58ffc702045b9284e84a32178e0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b20ca61af8ab58ffc702045b9284e84a32178e0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/bad2ddc3/attachment-0001.htm>