[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 6 08:15:01 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
51d953a2 by security tracker role at 2026-10-06T07:14:54+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-97300 (Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97257 (Deserialization of Untrusted Data vulnerability in PressTigers Simple ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95265 (Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerab ...)
TODO: check
CVE-2026-95264 (Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated ...)
@@ -9,19 +9,19 @@ CVE-2026-95264 (Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authent
CVE-2026-95263 (Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privi ...)
TODO: check
CVE-2026-94299 (The elegro Crypto Payment WordPress plugin through 1.0.1 does not requ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94293 (An unauthenticated remote attacker can modify Asset Administration She ...)
TODO: check
CVE-2026-94278 (The File Media Renamer WordPress plugin through 1.3 does not verify th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94271 (The Deema Payment Gateway WordPress plugin through 1.1.2 does not veri ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94270 (The Deema Payment Gateway WordPress plugin through 1.1.2 does not veri ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94201 (Ash stores :atom-typed attributes as strings and compares them as stri ...)
TODO: check
CVE-2026-93617 (Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93326 (A build step for a Git source, crafted in a specific way, can bypass s ...)
TODO: check
CVE-2026-93321 (A malicious frontend can submit an LLB definition that causes buildkit ...)
@@ -33,9 +33,9 @@ CVE-2026-92821 (A flaw was found in SSSD. When configured to evaluate password e
CVE-2026-91107 (openSIS Classic 9.3 allows an authenticated user with the built-in tea ...)
TODO: check
CVE-2026-89289 (The Fast Courier WordPress plugin through 5.2.3 does not restrict an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86786 (The Slider Pro WordPress plugin through 1.0.0 does not perform any cap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84900 (Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could p ...)
TODO: check
CVE-2026-82989 (There is an input injection in vCast exposed network services in ViewS ...)
@@ -51,7 +51,7 @@ CVE-2026-78860 (An issue in Mercusys AC12 V2 allows a local attacker to execute
CVE-2026-77226 (Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vuln ...)
TODO: check
CVE-2026-75962 (The Post SMTP \u2013 Complete Email Deliverability and SMTP Solution w ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-71299 (A flaw was found in Maestro. Its REST API write endpoints were registe ...)
TODO: check
CVE-2026-71298 (A flaw was found in maestro. A remote attacker could exploit a SQL inj ...)
@@ -63,53 +63,53 @@ CVE-2026-59358 (Improper authentication (CWE-287) in the OAuth token endpoint in
CVE-2026-59357 (Insufficient verification of data authenticity (CWE-345) in the extern ...)
TODO: check
CVE-2026-57559 (Memory corruption while processing service requests.)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-57555 (Memory Corruption when executing system service routines due to improp ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-57554 (Memory Corruption when asynchronous threads access shared performance ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-57546 (Transient DOS when processing a continuous receive command with a zero ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-57545 (Memory corruption when processing draw objects of incorrect type durin ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-57537 (Memory Corruption when accessing and modifying geographic mapping data ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-41563 (Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41558 (Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files \u20 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39789 (Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39760 (Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39723 (Unauthenticated Broken Access Control in Morning for WooCommerce <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39599 (Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32582 (Contributor Broken Access Control in IATO MCP <= 1.11.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32576 (Customer Insecure Direct Object References (IDOR) in Faktur Pro for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25302 (Cryptographic Issue when processing non-ELF partitions, authentication ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25291 (Memory corruption when performing concurrent operations on shared memo ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25274 (Memory Corruption when processing concurrent DMA buffer allocation and ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25273 (Memory Corruption when processing camera operations due to out-of-boun ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25272 (Memory Corruption when processing camera CRE driver operations with im ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25270 (Memory corruption when processing command buffer requests with invalid ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25269 (Memory corruption when processing camera requests with excessive batch ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25267 (Memory corruption when non-secure loader rewrites page tables before s ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-25263 (Memory corruption while processing IOCTL command called from user spac ...)
- TODO: check
+ NOT-FOR-US: Qualcomm
CVE-2026-21589 (h3. Summary This is a vulnerability in Bitbucket Data Center, Conflue ...)
- TODO: check
+ NOT-FOR-US: Atlassian
CVE-2026-105786 (Joplin is an open source note-taking and to-do application that organi ...)
TODO: check
CVE-2026-105785 (Joplin is an open source note-taking and to-do application that organi ...)
@@ -121,7 +121,7 @@ CVE-2026-105783 (Joplin is an open source note-taking and to-do application that
CVE-2026-105782 (Scrapy is a high-level web crawling and scraping framework for Python. ...)
TODO: check
CVE-2026-105778 (A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affect ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-105776 (A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Mon ...)
TODO: check
CVE-2026-105775 (A security vulnerability has been detected in vllm-project vLLM up to ...)
@@ -189,15 +189,15 @@ CVE-2026-105708 (A flaw has been found in imgproxy up to 4.0.17. Affected by thi
CVE-2026-105707 (A security vulnerability has been detected in uptrace up to 2.1.0-beta ...)
TODO: check
CVE-2026-105706 (A weakness has been identified in SourceCodester Drug Recommendation S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105705 (A security flaw has been discovered in SourceCodester Drug Recommendat ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105704 (A vulnerability was identified in SourceCodester Drug Recommendation S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105703 (A vulnerability was determined in PHPGurukul User Registration & Login ...)
- TODO: check
+ NOT-FOR-US: PHPGurukul
CVE-2026-105701 (The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105699 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
TODO: check
CVE-2026-105698 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
@@ -275,7 +275,7 @@ CVE-2026-105487 (A vulnerability was found in yogeshojha reNgine up to 2.2.0. Af
CVE-2026-105486 (A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects t ...)
TODO: check
CVE-2026-105484 (A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu. ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-105472 (A weakness has been identified in girishsaraf Online-Appointment-Booki ...)
TODO: check
CVE-2026-105471 (A security flaw has been discovered in girishsaraf Online-Appointment- ...)
@@ -299,7 +299,7 @@ CVE-2026-105389 (A security vulnerability has been detected in feelec-yishu feel
CVE-2026-105388 (A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This ...)
TODO: check
CVE-2026-105072 (Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104852 (GraphQL Tools provides utilities for building, stitching, and mocking ...)
TODO: check
CVE-2026-104044 (A flaw was found in sssd. A local attacker can trigger a Denial of Ser ...)
@@ -339,19 +339,19 @@ CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation
CVE-2026-103433 (Docker Buildx Bake does not request the expected fs.read approval for ...)
TODO: check
CVE-2026-103348 (Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103337 (Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103066 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102262 (Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory r ...)
TODO: check
CVE-2026-101893 (Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load ...)
TODO: check
CVE-2026-100511 (Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Goog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100506 (Deserialization of Untrusted Data vulnerability in WP Spell Check WP S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-0482 (In AMD Versal\u2122 Adaptive SoC devices, insufficient boundary checks ...)
TODO: check
CVE-2026-0461 (Insufficient boundary validation in the USB boot mode implementation o ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/51d953a2f4786388542d81c56259aa4c882da889
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/51d953a2f4786388542d81c56259aa4c882da889
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/6872e134/attachment.htm>
More information about the debian-security-tracker-commits
mailing list