[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Oct 6 09:15:18 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
124bd208 by Salvatore Bonaccorso at 2026-10-06T10:14:55+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -144,13 +144,13 @@ CVE-2026-105767 (Improper Neutralization of Special Elements used in an OS Comma
 CVE-2026-105766 (Use of the backend-facing $scheme variable in the trailing-slash direc ...)
 	NOT-FOR-US: Chainguard
 CVE-2026-105764 (Immich is a high-performance self-hosted photo and video management so ...)
-	TODO: check
+	NOT-FOR-US: Immich
 CVE-2026-105763 (Twenty is an open-source CRM (customer relationship management) platfo ...)
-	TODO: check
+	NOT-FOR-US: Twenty CRM
 CVE-2026-105762 (Dify is an open-source LLM app development platform. Prior to 1.13.0,  ...)
-	TODO: check
+	NOT-FOR-US: Dify
 CVE-2026-105761 (Dify is an open-source LLM app development platform. Prior to 1.16.0,  ...)
-	TODO: check
+	NOT-FOR-US: Dify
 CVE-2026-105760 (vLLM is an inference and serving engine for large language models. Pri ...)
 	- vllm <itp> (bug #1095237)
 CVE-2026-105759 (vLLM is an inference and serving engine for large language models. Pri ...)
@@ -170,33 +170,33 @@ CVE-2026-105753 (vLLM is an inference and serving engine for large language mode
 CVE-2026-105752 (vLLM is an inference and serving engine for large language models. Pri ...)
 	- vllm <itp> (bug #1095237)
 CVE-2026-105751 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105750 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105749 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105748 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105747 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105746 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105745 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105744 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105743 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105742 (Docling simplifies document processing by parsing diverse formats and  ...)
-	TODO: check
+	NOT-FOR-US: Docling
 CVE-2026-105741 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
-	TODO: check
+	NOT-FOR-US: Langflow
 CVE-2026-105740 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
-	TODO: check
+	NOT-FOR-US: Langflow
 CVE-2026-105708 (A flaw has been found in imgproxy up to 4.0.17. Affected by this vulne ...)
-	TODO: check
+	NOT-FOR-US: imgproxy
 CVE-2026-105707 (A security vulnerability has been detected in uptrace up to 2.1.0-beta ...)
-	TODO: check
+	NOT-FOR-US: uptrace
 CVE-2026-105706 (A weakness has been identified in SourceCodester Drug Recommendation S ...)
 	NOT-FOR-US: SourceCodester
 CVE-2026-105705 (A security flaw has been discovered in SourceCodester Drug Recommendat ...)
@@ -208,35 +208,35 @@ CVE-2026-105703 (A vulnerability was determined in PHPGurukul User Registration
 CVE-2026-105701 (The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code E ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105699 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
-	TODO: check
+	NOT-FOR-US: Langflow
 CVE-2026-105698 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
-	TODO: check
+	NOT-FOR-US: Langflow
 CVE-2026-105697 (Langflow is a tool for building and deploying AI-powered agents and wo ...)
-	TODO: check
+	NOT-FOR-US: Langflow
 CVE-2026-105696 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105695 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105694 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105693 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105692 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105691 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105690 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105689 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105688 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105687 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105686 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105684 (Penpot is an open-source design and prototyping platform. Prior to 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-105683 (Ghost is a Node.js content management system. From 6.14.0 until 6.27.0 ...)
 	- ghost <itp> (bug #892150)
 CVE-2026-105682 (Ghost is a Node.js content management system. From 1.18.0 until 6.27.0 ...)
@@ -268,49 +268,49 @@ CVE-2026-105648 (Ghost is a Node.js content management system. From 6.0.9 until
 CVE-2026-105647 (Ghost is a Node.js content management system. From 6.54.1 until 6.65.0 ...)
 	- ghost <itp> (bug #892150)
 CVE-2026-105621 (A security flaw has been discovered in jishenghua jshERP up to 3.5. Af ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-105611 (A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. ...)
-	TODO: check
+	NOT-FOR-US: chillzhuang SpringBlade
 CVE-2026-105610 (A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The  ...)
-	TODO: check
+	NOT-FOR-US: chillzhuang SpringBlade
 CVE-2026-105573 (A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This  ...)
-	TODO: check
+	NOT-FOR-US: newbee-ltd newbee-mall
 CVE-2026-105572 (A vulnerability has been found in PickMall Lilishop up to 4.2.4. This  ...)
-	TODO: check
+	NOT-FOR-US: PickMall Lilishop
 CVE-2026-105571 (A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted e ...)
-	TODO: check
+	NOT-FOR-US: PickMall Lilishop
 CVE-2026-105487 (A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected  ...)
-	TODO: check
+	NOT-FOR-US: yogeshojha reNgine
 CVE-2026-105486 (A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects t ...)
-	TODO: check
+	NOT-FOR-US: OSSRS SRS (Simple Realtime Server)
 CVE-2026-105484 (A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu. ...)
 	NOT-FOR-US: TOTOLINK
 CVE-2026-105472 (A weakness has been identified in girishsaraf Online-Appointment-Booki ...)
-	TODO: check
+	NOT-FOR-US: girishsaraf Online-Appointment-Booking-System
 CVE-2026-105471 (A security flaw has been discovered in girishsaraf Online-Appointment- ...)
-	TODO: check
+	NOT-FOR-US: girishsaraf Online-Appointment-Booking-System
 CVE-2026-105470 (A vulnerability was identified in girishsaraf Online-Appointment-Booki ...)
-	TODO: check
+	NOT-FOR-US: girishsaraf Online-Appointment-Booking-System
 CVE-2026-105469 (A vulnerability was determined in girishsaraf Online-Appointment-Booki ...)
-	TODO: check
+	NOT-FOR-US: girishsaraf Online-Appointment-Booking-System
 CVE-2026-105468 (A vulnerability was found in girishsaraf Online-Appointment-Booking-Sy ...)
-	TODO: check
+	NOT-FOR-US: girishsaraf Online-Appointment-Booking-System
 CVE-2026-105447 (A flaw was found in Quay. When handling build trigger requests, the ap ...)
-	TODO: check
+	NOT-FOR-US: Red Hat Quay
 CVE-2026-105444 (A security flaw has been discovered in dotnet eShop .NET 8. The impact ...)
-	TODO: check
+	NOT-FOR-US: dotnet eShop
 CVE-2026-105438 (A flaw has been found in O2OA up to 10.0.1-ce. This affects the functi ...)
-	TODO: check
+	NOT-FOR-US: O2OA
 CVE-2026-105392 (A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.1 ...)
-	TODO: check
+	NOT-FOR-US: Lybbn Django-Vue-Lyadmin
 CVE-2026-105389 (A security vulnerability has been detected in feelec-yishu feelcrm-os  ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105388 (A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This  ...)
-	TODO: check
+	NOT-FOR-US: feelec-yishu feelcrm-os
 CVE-2026-105072 (Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 ver ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104852 (GraphQL Tools provides utilities for building, stitching, and mocking  ...)
-	TODO: check
+	NOT-FOR-US: GraphQL Tools
 CVE-2026-104044 (A flaw was found in sssd. A local attacker can trigger a Denial of Ser ...)
 	- sssd <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478664
@@ -360,7 +360,7 @@ CVE-2026-104029 (A flaw was found in SSSD. A local attacker can exploit this vul
 	- sssd <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479444
 CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation of Ops  ...)
-	TODO: check
+	NOT-FOR-US: MongoDB Controllers for Kubernetes
 CVE-2026-103433 (Docker Buildx Bake does not request the expected fs.read approval for  ...)
 	TODO: check
 CVE-2026-103348 (Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP ...)
@@ -370,17 +370,17 @@ CVE-2026-103337 (Missing Authorization vulnerability in Kirillbdev WC Ukraine Sh
 CVE-2026-103066 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-102262 (Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory r ...)
-	TODO: check
+	NOT-FOR-US: Newell Brands DYMO ID
 CVE-2026-101893 (Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load ...)
-	TODO: check
+	NOT-FOR-US: Newell Brands DYMO ID
 CVE-2026-100511 (Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Goog ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-100506 (Deserialization of Untrusted Data vulnerability in WP Spell Check WP S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-0482 (In AMD Versal\u2122 Adaptive SoC devices, insufficient boundary checks ...)
-	TODO: check
+	NOT-FOR-US: AMD
 CVE-2026-0461 (Insufficient boundary validation in the USB boot mode implementation o ...)
-	TODO: check
+	NOT-FOR-US: AMD
 CVE-2026-104380 (Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT re ...)
 	NOT-FOR-US: Punk Perl module
 CVE-2026-55480



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/124bd208644fc72dc8ef428868d821d9e0648e6e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/124bd208644fc72dc8ef428868d821d9e0648e6e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/9a7483e5/attachment.htm>

More information about the debian-security-tracker-commits mailing list