[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d2764188 by Salvatore Bonaccorso at 2026-10-03T13:31:50+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -182,31 +182,31 @@ CVE-2026-104874 (Multidict is an implementation of a multidict data structure. F
 CVE-2026-104873 (LangGraph Python SDK is used to connect to running LangGraph API serve ...)
 	NOT-FOR-US: LangGraph Python SDK
 CVE-2026-104872 (OpenTelemetry JavaScript Contrib provides instrumentation libraries fo ...)
-	TODO: check
+	NOT-FOR-US: OpenTelemetry JavaScript Contrib
 CVE-2026-104871 (The Angular SSR is a server-rise rendering tool for Angular applicatio ...)
-	TODO: check
+	NOT-FOR-US: Angular SSR
 CVE-2026-104479 (Shopclass before 6.2.0 contains a stored cross-site scripting vulnerab ...)
-	TODO: check
+	NOT-FOR-US: Shopclass
 CVE-2026-104478 (Formwork before 2.3.13 contains a path traversal vulnerability in Back ...)
-	TODO: check
+	NOT-FOR-US: Formwork
 CVE-2026-104477 (Showdown through 2.1.0 contains a cross-site scripting vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: Showdown
 CVE-2026-104476 (Backdrop CMS before 1.35.1 contains an information disclosure vulnerab ...)
 	TODO: check
 CVE-2026-104475 (IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vu ...)
-	TODO: check
+	NOT-FOR-US: IDURAR ERP CRM
 CVE-2026-104474 (OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulne ...)
-	TODO: check
+	NOT-FOR-US: OpenLiteSpeed
 CVE-2026-104433 (Mooncake transfer engine before 0.3.12 contains an out-of-bounds read  ...)
-	TODO: check
+	NOT-FOR-US: Mooncake transfer engine
 CVE-2026-104313 (The WPC Estimated Delivery Date for WooCommerce plugin for WordPress i ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104055 (The postgresql-operator charm runs a Prometheus postgres_exporter to c ...)
-	TODO: check
+	NOT-FOR-US: postgresql-operator
 CVE-2026-104019 (OS command injection in the Studio Space startup validation script in  ...)
 	NOT-FOR-US: Amazon
 CVE-2026-103918 (oRPC is a tool that helps build APIs that are end-to-end type-safe and ...)
-	TODO: check
+	NOT-FOR-US: oRPC
 CVE-2026-103913 (The GeoDirectory plugin for WordPress is vulnerable to SQL Injection v ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-103909 (The Calculated Fields Form \u2013 AI Form Builder for WordPress \u2013 ...)
@@ -706,7 +706,7 @@ CVE-2026-104846 (Seroval facilitates JS value stringification, including complex
 CVE-2026-104845 (Seroval facilitates JS value stringification, including complex struct ...)
 	NOT-FOR-US: Seroval
 CVE-2026-104844 (PostCSS Selector Parser is a CSS selector parser that integrates with  ...)
-	TODO: check
+	NOT-FOR-US: PostCSS Selector Parser
 CVE-2026-104843 (uv is a Python package and project manager written in Rust. From 0.12. ...)
 	- uv <not-affected> (Windows-specific)
 	NOTE: https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7
@@ -889,7 +889,7 @@ CVE-2026-103763 (SiYuan before v3.8.5 contains an information disclosure vulnera
 CVE-2026-103762 (SiYuan before v3.8.5 contains a missing authorization vulnerability in ...)
 	NOT-FOR-US: SiYuan
 CVE-2026-103648 (Path traversal in image-downloader 4.3.0 allows an attacker who can co ...)
-	TODO: check
+	NOT-FOR-US: image-downloader
 CVE-2026-103631 (Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allo ...)
 	TODO: check
 CVE-2026-103630 (Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowe ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d2764188ed0b3f48639a83d4f69185213826dc38

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d2764188ed0b3f48639a83d4f69185213826dc38
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/7569db67/attachment.htm>