[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Mon Oct 5 21:51:56 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4a630fb4 by Salvatore Bonaccorso at 2026-10-05T22:51:32+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -290,19 +290,19 @@ CVE-2026-105315 (A vulnerability has been found in django-haystack up to 3.3.0.
 	NOTE: https://github.com/django-haystack/django-haystack/security/advisories/GHSA-r3hx-x5rh-p9vv
 	NOTE: Fixed by: https://github.com/django-haystack/django-haystack/commit/eb05f193c9771a68dcc8cfac6674a0d48a52ee9d (v3.4.0)
 CVE-2026-105314 (Papermerge 3.5.3 allows remote code execution by a standard user via d ...)
-	TODO: check
+	NOT-FOR-US: Papermerge
 CVE-2026-105307 (A vulnerability was detected in Casdoor up to 3.161.1. Affected is the ...)
-	TODO: check
+	NOT-FOR-US: Casdoor
 CVE-2026-105291 (A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This  ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105290 (A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This  ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105289 (A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected b ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105288 (A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affec ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105287 (A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105286 (A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. ...)
 	NOT-FOR-US: TOTOLINK
 CVE-2026-105285 (A security vulnerability has been detected in Totolink A3002MU 1.0.0-B ...)
@@ -318,13 +318,13 @@ CVE-2026-105254 (A vulnerability was identified in itsourcecode Online Admission
 CVE-2026-105253 (A vulnerability was determined in itsourcecode Online Admission System ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2026-105251 (A vulnerability was detected in vgmstream up to r2117. Affected by thi ...)
-	TODO: check
+	NOT-FOR-US: vgmstream
 CVE-2026-105250 (A security vulnerability has been detected in vgmstream up to r2117. A ...)
-	TODO: check
+	NOT-FOR-US: vgmstream
 CVE-2026-105249 (A weakness has been identified in vgmstream up to r2117. This impacts  ...)
-	TODO: check
+	NOT-FOR-US: vgmstream
 CVE-2026-105248 (A security flaw has been discovered in vgmstream up to r2117. This aff ...)
-	TODO: check
+	NOT-FOR-US: vgmstream
 CVE-2026-105247 (A vulnerability was determined in SourceCodester Online Reviewer Manag ...)
 	NOT-FOR-US: SourceCodester
 CVE-2026-105073 (Exposure of Sensitive System Information to an Unauthorized Control Sp ...)
@@ -386,7 +386,7 @@ CVE-2026-104956 (Plane is an open-source project management tool. Prior to 1.4.0
 CVE-2026-104955 (Plane is an open-source project management tool. Prior to 1.4.0, a Pro ...)
 	NOT-FOR-US: Plane
 CVE-2026-104905 (FacturaScripts before version 2026.7 contains a PHP object injection v ...)
-	TODO: check
+	NOT-FOR-US: FacturaScripts
 CVE-2026-104894 (Plane is an open-source project management tool. Prior to 1.4.0, the m ...)
 	NOT-FOR-US: Plane
 CVE-2026-104893 (Plane is an open-source project management tool. Prior to 1.4.0, GET / ...)
@@ -394,23 +394,23 @@ CVE-2026-104893 (Plane is an open-source project management tool. Prior to 1.4.0
 CVE-2026-104892 (Plane is an open-source project management tool. Prior to 1.4.0, aPITo ...)
 	NOT-FOR-US: Plane
 CVE-2026-104891 (mppx-condition-gate provides conditional free-access wrappers for mppx ...)
-	TODO: check
+	NOT-FOR-US: mppx-condition-gate
 CVE-2026-104890 (Kunstmaan CMS is an open source content management system based on the ...)
-	TODO: check
+	NOT-FOR-US: Kunstmaan CMS
 CVE-2026-104811 (DigitalCanion SA has discovered a vulnerability that allows remote att ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104810 (This vulnerability allows remote attackers to delete sensitive files o ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104809 (DigitalCanion has discovered a vulnerability that allows an attacker t ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104808 (DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulne ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104807 (DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulne ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104806 (DigitalCanion has discovered a path traversal vulnerability that allow ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104805 (DigitalCanion has discovered a vulnerability in the backup restoration ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104714 (Concurrent execution using shared resource with improper synchronizati ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-104713 (Allocation of resources without limits or throttling vulnerability in  ...)
@@ -420,7 +420,7 @@ CVE-2026-104712 (Asymmetric resource consumption (amplification) vulnerability i
 CVE-2026-104711 (Improper neutralization of special elements used in an expression lang ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-104706 (DigitalCanion has discovered a path traversal vulnerability that allow ...)
-	TODO: check
+	NOT-FOR-US: DigitalCanion
 CVE-2026-104675 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104673 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -450,13 +450,13 @@ CVE-2026-104386 (Missing Authorization vulnerability in WPFunnels Team WP VR wpv
 CVE-2026-103684 (Missing Authorization vulnerability in Arraytics WP Event Solution wp- ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103512 (Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address  ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2026-103511 (Perforce P4 Search prior to 2026.4.2 does notvalidatefile names suppli ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2026-103510 (P4 Search prior to 2026.4.2 does not fail securely when its service au ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2026-103507 (Perforce P4 Search prior to 2026.4.2 does not restrict file paths writ ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2026-103352 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103351 (Improper Validation of Specified Quantity in Input vulnerability in Ma ...)
@@ -492,7 +492,7 @@ CVE-2026-102776 (Joomla Extension - svenbluege.de - Cross-site request forgery o
 CVE-2026-102775 (Joomla Extension - phoca.cz - Authorisation bypass through user-contro ...)
 	NOT-FOR-US: Joomla
 CVE-2026-102576 (A flaw was found in Quay. A remote attacker could trick a user into lo ...)
-	TODO: check
+	NOT-FOR-US: Red Hat Quay
 CVE-2026-102428 (Joomla Extension - ordasoft.com - Unauthenticated SQL injection in Ord ...)
 	NOT-FOR-US: Joomla
 CVE-2026-102426 (Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Conte ...)
@@ -502,19 +502,19 @@ CVE-2026-102393 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-102383 (Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-102295 (A flaw was found in Quay. A cross-site scripting (XSS) vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: Red Hat Quay
 CVE-2026-102282 (adm-zip is a JavaScript library for creating and extracting ZIP archiv ...)
-	TODO: check
+	NOT-FOR-US: adm-zip
 CVE-2026-101919 (A flaw was found in the HyperShift operator. The operator copies user- ...)
-	TODO: check
+	NOT-FOR-US: HyperShift operator
 CVE-2026-100515 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-100509 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-100103 (Perforce P4 Search container images prior to 2026.4.2 reset the servic ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2026-100102 (Perforce P4 Search container images prior to 2026.4.2enablean unauthen ...)
-	TODO: check
+	NOT-FOR-US: Perforce
 CVE-2025-15643 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-XXXX [OSSN-0112]



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a630fb487587527b61a9b92a1434d66679c6de6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a630fb487587527b61a9b92a1434d66679c6de6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/98995b58/attachment.htm>

More information about the debian-security-tracker-commits mailing list