[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 6 20:16:15 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7e790ca5 by security tracker role at 2026-10-06T19:15:41+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
CVE-2026-9226 (Authentication bypass in the Azure AD external login flow in Devolutio ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-97308 (Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96890 (A Server-Side Request Forgery (SSRF) vulnerability was identified in G ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-95594 (Unauthenticated Privilege Escalation in SMS Alert Order Notifications ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95526 (Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95153 (An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensi ...)
TODO: check
CVE-2026-95140 (kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulner ...)
@@ -15,19 +15,19 @@ CVE-2026-95140 (kkFileView v5.0.0 through v5.0.2 contains a directory traversal
CVE-2026-95105 (Reliance on Obfuscation or Encryption of Security-Relevant Inputs with ...)
TODO: check
CVE-2026-94675 (Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94206 (Use of Password Hash With Insufficient Computational Effort vulnerabil ...)
TODO: check
CVE-2026-91140 (An OS command injection vulnerability in the shell-based temporary-fil ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-88252 (A flaw was found in sssd. A local user can cause a Denial of Service ( ...)
TODO: check
CVE-2026-86362 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Ac ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-86361 (Dell System Update, versions prior to 2.3.0.0, contains an Incorrect P ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-86360 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Li ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-85523 (Improper neutralization of special elements used in an OS command ('OS ...)
TODO: check
CVE-2026-85153 (This vulnerability exists in the Schmooze app due to the use of hardco ...)
@@ -41,13 +41,13 @@ CVE-2026-82924 (Improper Control of Interaction Frequency vulnerability in Pusul
CVE-2026-82531 (Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vul ...)
TODO: check
CVE-2026-82162 (Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80327 (An open redirect vulnerability exists in the PingGateway Fragment Filt ...)
- TODO: check
+ NOT-FOR-US: Ping Identity Corporation
CVE-2026-77178 (Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an ou ...)
TODO: check
CVE-2026-76105 (Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-75820 (GNU Aspell contains an integer truncation vulnerability in the Writabl ...)
TODO: check
CVE-2026-75819 (GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDic ...)
@@ -55,243 +55,243 @@ CVE-2026-75819 (GNU Aspell contains an out-of-bounds read vulnerability in ReadO
CVE-2026-75818 (GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerabil ...)
TODO: check
CVE-2026-71168 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Li ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-70414 (Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-70411 (Dell Container Storage Modules (CSM), versions prior to 1.18.0, contai ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67273 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67270 (Dell Container Storage Modules (CSM) versions prior to 1.18.0, contain ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-67269 (Dell Container Storage Modules (CSM) Operator, versions prior to 1.18. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-66666 (Insertion of Sensitive Information Into Sent Data vulnerability in Aut ...)
TODO: check
CVE-2026-66588 (Unauthenticated Broken Access Control in The7 <= 14.2.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-63697 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Ce ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63692 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63691 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63690 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63689 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-63688 (Dell Container Storage Modules (CSM), versions prior to v1.18.0, conta ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-62072 (Subscriber Broken Access Control in Progress Planner <= 1.10.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61421 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-61411 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-56952 (In platform_msg_handler_init of default_msg_handlers.c, there is a pos ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56936 (In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-o ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56906 (In ep_free of eventpoll.c, there is a possible use-after-free due to a ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-56596 (HCL BigFix Service Management is affected by an Improper Input Validat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-55330 (In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a pos ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-55307 (In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible informa ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2026-54472 (Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-4889 (SQL injection (SQLi) vulnerability in the eLoanApp application, specif ...)
TODO: check
CVE-2026-48199 (Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48197 (Incorrect Privilege Assignment vulnerability in PublishPress PublishPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42638 (Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42637 (Unauthenticated Settings Change in PayPlug for WooCommerce (Official) ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42636 (Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42635 (Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Aucti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42634 (Unauthenticated Cross Site Scripting (XSS) in Video Background Block \ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42418 (Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42417 (Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42416 (Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42415 (Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42414 (Subscriber SQL Injection in ListingPro <= 2.9.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42413 (Unauthenticated Sensitive Data Exposure in Snapshotify – All-in- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41562 (Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41561 (Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41560 (Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41559 (Unauthenticated Sensitive Data Exposure in SafeSnap \u2013 Verified Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-41555 (Unauthenticated SQL Injection in Newsletter Subscription Form \u2013 U ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40807 (Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Comple ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40806 (Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39798 (Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39797 (Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39796 (Unauthenticated Broken Access Control in Advanced Posts Listing \u2013 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39795 (Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39794 (Unauthenticated Broken Access Control in WooCommerce Multivendor Marke ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39793 (Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39792 (Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39791 (Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39790 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.6 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39788 (Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39787 (Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39785 (Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39784 (Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39781 (Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39780 (Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39778 (Unauthenticated Cross Site Scripting (XSS) in Ansar Import \u2013 One ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39776 (Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39775 (Subscriber Privilege Escalation in JobZilla - Job Board WordPress Them ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39774 (Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39773 (Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39772 (Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39771 (Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39770 (Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39769 (Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39768 (Unauthenticated Cross Site Scripting (XSS) in Security & Malware scan ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39767 (Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39766 (Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39765 (Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39764 (Unauthenticated SQL Injection in Radius Booking \u2014 Booking Calenda ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39762 (Missing Authorization vulnerability in Patterns In The Cloud Autoship ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39761 (Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39759 (Employer / Sales Representative Arbitrary File Upload in Workreap Core ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39758 (Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39757 (Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39756 (Unauthenticated Insecure Direct Object References (IDOR) in Wappointme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39755 (Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39754 (Contributor Arbitrary File Download in Piotnet Addons For Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39753 (Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39752 (Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39751 (Unauthenticated Broken Access Control in PayPlug for WooCommerce (Offi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39750 (Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39749 (Subscriber Broken Access Control in App for Cloudflare\xae <= 1.10.1 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39748 (Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39747 (Subscriber SQL Injection in Woffice <= 5.4.35 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39746 (Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39745 (Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by Be ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39731 (Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39730 (Missing Authorization vulnerability in Marcin Wise Chat wise-chat allo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39729 (Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39728 (Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39727 (Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39726 (Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39725 (Contributor Remote Code Execution (RCE) in Content Visibility for Divi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39724 (Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39722 (Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39720 (Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39719 (Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-34498 (Improper input validation vulnerability in Johnson Controls Illustra S ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-32581 (Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32580 (Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32579 (Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32578 (Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32577 (Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32575 (Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32574 (Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32572 (Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32571 (Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32570 (Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressiv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32569 (Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32568 (Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-32557 (Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-26287 (External Secrets Operator reads information from a third-party service ...)
TODO: check
CVE-2026-25434 (Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25433 (Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-12380 (Improper neutralization of input during web page generation ('cross-si ...)
TODO: check
CVE-2026-106513 (MISP (Malware Information Sharing Platform) exposes critical infrastru ...)
@@ -725,9 +725,9 @@ CVE-2026-106221 (Confused deputy in WebAPKs in Google Chrome on on Android prior
CVE-2026-106220 (Information leak in Passwords in Google Chrome prior to 155.0.8059.39 ...)
TODO: check
CVE-2026-106219 (In JetBrains TeamCity before 2026.2.1 missing validation of Git submod ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-106218 (In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox esc ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-106217 (Missing authorization in Google Lens in Google Chrome prior to 155.0.8 ...)
TODO: check
CVE-2026-106216 (Cross-site request forgery in ReadingList in Google Chrome on on Andro ...)
@@ -869,9 +869,9 @@ CVE-2026-106026 (tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerab
CVE-2026-106016 (Mitigation bypass in the File Handling component. This vulnerability w ...)
TODO: check
CVE-2026-105985 (Craft CMS 5.10.13.2 contains an authenticated remote code execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-105957 (A vulnerability was detected in SourceCodester Performance Indicator S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105950 (A security vulnerability has been detected in getformwork formwork up ...)
TODO: check
CVE-2026-105922 (A security flaw has been discovered in vllm-project vLLM up to 0.31.0. ...)
@@ -885,7 +885,7 @@ CVE-2026-105919 (A vulnerability was found in Kusalkasilva Learning-Management-S
CVE-2026-105918 (A vulnerability has been found in Kusalkasilva Learning-Management-Sys ...)
TODO: check
CVE-2026-105879 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105868 (Payload is a free and open source headless content management system. ...)
TODO: check
CVE-2026-105867 (Payload is a free and open source headless content management system. ...)
@@ -955,11 +955,11 @@ CVE-2026-105835 (PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes
CVE-2026-105834 (Rundeck before 6.2.0 contains a path traversal vulnerability that allo ...)
TODO: check
CVE-2026-105809 (A vulnerability was identified in SourceCodester Simple Student Inform ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105808 (A vulnerability was determined in SourceCodester Simple Student Inform ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105807 (A vulnerability was found in SourceCodester Simple Student Information ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-105806 (Payload is a free and open source headless content management system. ...)
TODO: check
CVE-2026-105805 (Payload is a free and open source headless content management system. ...)
@@ -995,55 +995,55 @@ CVE-2026-105789 (Microsoft UFO is an open-source framework for intelligent autom
CVE-2026-105788 (Microsoft UFO is an open-source framework for intelligent automation a ...)
TODO: check
CVE-2026-105488 (Missing authorization in the global vault in Devolutions Server 2026.3 ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-105485 (Authentication bypass OAuth device authorization flow in Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-105317 (Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105305 (A flaw was found in the OIDC implementation of Keycloak, specifically ...)
TODO: check
CVE-2026-105071 (Unauthenticated Sensitive Data Exposure in SiteVault \u2013 Backup, Re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105070 (Unauthenticated Privilege Escalation in Salon booking system <= 10.31. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105061 (Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105059 (Subscriber Broken Access Control in Delete All Comments of wordpress < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105058 (Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105057 (Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104945 (TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerabi ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104944 (TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer disp ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104850 (MCP TypeScript SDK is the official TypeScript SDK for Model Context Pr ...)
TODO: check
CVE-2026-104814 (Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104757 (Editor Privilege Escalation in Import and export users and customers < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104747 (Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104672 (Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104670 (Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104406 (Unauthenticated Broken Access Control in picu <= 3.10.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104405 (Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104399 (Insertion of Sensitive Information Into Sent Data vulnerability in Sty ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104395 (Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104394 (Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104387 (Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104385 (Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104073 (NetBox versions 2.9.5 before 4.7.0 contain a server-side template inje ...)
TODO: check
CVE-2026-104070 (The Crayons plugin for SPIP before 3.5.0 contains a missing authorizat ...)
@@ -1053,23 +1053,23 @@ CVE-2026-104069 (HortusFox before 6.2 contains a remote code execution vulnerabi
CVE-2026-103831 (CVE-2026-103831: Insecure deserialization vulnerability in the Psr16Ca ...)
TODO: check
CVE-2026-103778 (Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a U ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-103620 (A missing authorization vulnerability was identified in GitHub Enterpr ...)
- TODO: check
+ NOT-FOR-US: Github Enterprise Server
CVE-2026-103346 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102915 (Subscriber Broken Access Control in WPO365 <= 44.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102387 (Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102322 (Incorrect Authorization in SiteIsolation in Google Chrome prior to 155 ...)
TODO: check
CVE-2026-101207 (Dell OpenManage Integration with Microsoft Windows Admin Center, versi ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-100518 (Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-0198 (In is_pd_allowed of gem_msg.c, there is a possible permission bypass d ...)
- TODO: check
+ NOT-FOR-US: Google devices
CVE-2025-8352 (Allocation of resources without limits or throttling vulnerability in ...)
TODO: check
CVE-2025-71384 (Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi ...)
@@ -1079,7 +1079,7 @@ CVE-2025-71383 (Dbit WIFI4 N300 1.0.0 devices allow the management interface to
CVE-2025-45871 (LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL i ...)
TODO: check
CVE-2025-15591 (Cross-site Scripting (XSS) in the Forums feature of OpenText Content M ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-77050 (An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, ...)
- python-django 3:5.2.18-1 (bug #1150176)
NOTE: https://www.djangoproject.com/weblog/2026/oct/06/security-releases/
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e790ca55f74f3f7cc5b5a8ad873b3a889caebbd
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e790ca55f74f3f7cc5b5a8ad873b3a889caebbd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/68405f2b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list