[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 08:14:51 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
b5a28a29 by security tracker role at 2026-10-07T07:14:44+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,87 +1,87 @@
CVE-2026-97680 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97676 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97673 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97671 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97655 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-97626 (Requesting a user or organization profile page (`GET /{username}`) wit ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-97354 (The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97331 (The User Private Files WordPress plugin before 2.1.9 does not validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97208 (The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/ ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-97188 (The String locator WordPress plugin before 2.6.8 does not restrict the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96594 (The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepa ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-96589 (When a private repository is transferred to a user who lacks access, G ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-96580 (Gitea expanded a workflow's static `strategy.matrix` into its full Car ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-96530 (The Optimole WordPress plugin before 4.2.15 does not perform a capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96404 (When Gitea's web installer is reachable against a database that alread ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-96400 (With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `* ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-96399 (A repository's external issue tracker regular expression containing al ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-95112 (When processing issue and comment bodies, Gitea scanned the entire pre ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-95106 (Gitea accepted pushed Git trees containing two entries with the same n ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed approval ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in Apache Co ...)
TODO: check
CVE-2026-93679 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93678 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93677 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93675 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93674 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93449 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93448 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93447 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with acc ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93445 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93443 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-89430 (Gitea validated a push mirror's remote address against the `[migration ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-89182 (With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositori ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-88962 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-87971 (The If-So Dynamic Content WordPress plugin before 1.10.2 does not val ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87782 (The Koinonia Link WordPress plugin before 1.1.5 does not check that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86833 (The MetForm WordPress plugin before 4.3.1 does not sanitize or escape ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86816 (The WPCafe WordPress plugin before 3.0.21 does not restrict access to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86684 (The Gitea push mirror API checked whether the repository owner, instea ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-84897 (src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-c ...)
TODO: check
CVE-2026-83742 (Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolf ...)
@@ -89,99 +89,99 @@ CVE-2026-83742 (Unsigned integer underflow in wstrncat() in src/port.c in wolfSS
CVE-2026-83540 (When password or public key authentication is used with the Windows po ...)
TODO: check
CVE-2026-82212 (The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82211 (The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81535 (In wolfSSH through 1.5.0 built with--enable-fwd,DoChannelOpen()insrc/i ...)
TODO: check
CVE-2026-80048 (A flaw was found in `sssd-kcm`. A local user or process able to connec ...)
TODO: check
CVE-2026-79960 (When a push was authenticated with a deploy key, Gitea recorded the re ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-79818 (A vulnerability in an API interface of ClearPass Policy Manager could ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79817 (A sensitive information disclosure vulnerability exists in the client ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79816 (A vulnerability in a client interface of HPE Networking ClearPass Poli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79815 (A command injection vulnerability in the OnGuard agent of ClearPass Po ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79814 (An arbitrary file write vulnerability in the ClearPass Policy Manager ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79813 (A local privilege escalation vulnerability exists in the ClearPass cli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79812 (A denial of service vulnerability exists in the OnGuard agent of HPE N ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79811 (A SQL injection vulnerability in the API of ClearPass Policy Manager c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79810 (Remote code execution vulnerabilities exist in the affected interface ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79809 (An unauthenticated path traversal vulnerability exists in an API endpo ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79808 (A buffer overflow vulnerability exists in the OnGuard agent of ClearPa ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79807 (A missing integrity verification vulnerability in the Windows client s ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79806 (A privilege escalation vulnerability in the ClearPass Policy Manager O ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79805 (An authenticated path traversal vulnerability exists in ClearPass Poli ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79803 (A command injection vulnerability exists in the API of ClearPass Polic ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79802 (A command injection vulnerability exists in the client software of Cle ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79801 (A missing integrity verification vulnerability in the client agent sof ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79800 (An authenticated path traversal vulnerability exists in the command li ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79799 (A vulnerability in the web-based management interface of ClearPass Pol ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79798 (SQL injection vulnerabilities in the web-based management interface of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79797 (An improper access control vulnerability exists in the Android client ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79796 (Vulnerabilities have been identified in the affected interface of Clea ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79794 (A SQL injection vulnerability in the web-based management interface of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76754 (A vulnerability in an affected interface of ClearPass Policy Manager c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76753 (A format string vulnerability in an affected service interface of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76752 (Authentication bypass vulnerabilities exist in the web-based managemen ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76751 (A missing integrity verification vulnerability exists in the OnGuard a ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76750 (Deserialization of untrusted data vulnerabilities exist in the web int ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76749 (A sensitive information disclosure vulnerability exists in AOS-S. Succ ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76748 (A privilege escalation vulnerability exists in the API of AOS-S. Succe ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76747 (Buffer overflow vulnerabilities exist in the affected interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76746 (An unauthenticated buffer overflow vulnerability exists in AOS-S. Succ ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76745 (Memory corruption vulnerabilities exist in AOS-S that are reachable by ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76744 (Buffer overflow vulnerabilities exist in the affected interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76743 (A vulnerability have been identified in the management interface of AO ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76742 (Authentication bypass vulnerabilities exist in the web management inte ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76741 (Buffer overflow vulnerabilities exist in the affected interface of AOS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76061 (A flaw was found in CRI-O's `bind_mount_prefix` handling. When configu ...)
TODO: check
CVE-2026-73278 (Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAu ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-70357 (Gitea validates a repository migration hostname against its network al ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-65142 (NVIDIA Model-Optimizer contains a vulnerability where an attacker may ...)
TODO: check
CVE-2026-65122 (NVIDIA TensorRT contains a vulnerability where an attacker can cause a ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-59347 (VMware Workstation and Fusion contain a stack-based buffer-overflow vu ...)
TODO: check
CVE-2026-59346 (VMware Workstation and Fusion contain an integer-overflow vulnerabilit ...)
@@ -191,17 +191,17 @@ CVE-2026-43598 (Improper input validation in the AMD ROCm Communication Collecti
CVE-2026-19572 (A security vulnerability has been identified in FlexNet Publisher lmad ...)
TODO: check
CVE-2026-19396 (A predictable seed in the pseudo-random number generator (PRNG) in the ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-19386 (A stack-based buffer overflow in the ASUS router modules allows an aut ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-19029 (A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zs ...)
TODO: check
CVE-2026-16528 (Insertion of Sensitive Information into Log File in certain ASUS route ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-16516 (wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_R ...)
TODO: check
CVE-2026-14911 (Improper Neutralization of Input During Web Page Generation (\u201cCro ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-106589 (In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 ...)
TODO: check
CVE-2026-106588 (In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK ha ...)
@@ -323,21 +323,21 @@ CVE-2026-106062 (A heap-based buffer overflow was found in GIMP\u2019s DirectDra
CVE-2026-106061 (A flaw was found in GIMP\u2019s X cursor (XMC) thumbnail loader. When ...)
TODO: check
CVE-2026-106032 (Server-side request forgery in the OpenAPI schema processing of the ag ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105812 (Improper control of code generation in the agent import functionality ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105811 (Authorization bypass through a user-controlled key in the optional Ama ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-105324 (An HTTP header injection vulnerability in start-page-loader.cgi of ADM ...)
- TODO: check
+ NOT-FOR-US: Asustor
CVE-2026-105322 (The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105316 (The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105268 (The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{re ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-105267 (The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/dele ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-105244 (Improper Encoding or Escaping of Output vulnerability in the RemoteSys ...)
TODO: check
CVE-2026-105243 (Insufficient Logging vulnerability in the EventLogAppender of Apache l ...)
@@ -353,35 +353,35 @@ CVE-2026-105239 (Improper Neutralization of Null Byte or NUL Character vulnerabi
CVE-2026-105111 (Improper neutralization of input during web page generation ('cross-si ...)
TODO: check
CVE-2026-104953 (The MPG WordPress plugin before 4.2.3 does not properly validate the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104678 (The CP Media Player WordPress plugin before 1.3.4 does not perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104677 (The WP Coder WordPress plugin before 4.5.2 does not restrict access t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104667 (The Animated Number Counters WordPress plugin before 3.1 does not sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104653 (The Envira Gallery WordPress plugin before 1.16.1 does not sanitise o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104652 (The Envira Gallery WordPress plugin before 1.16.1 does not sanitise a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104651 (The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104636 (Gitea validated the initial remote URL for push mirrors, wiki remote c ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-104633 (When migrating a repository from another Gitea instance, Gitea used th ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-104632 (Gitea Actions blocks the jobs of workflow runs from first-time fork pu ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-104626 (A user who can open a fork pull request can place workflow content wit ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-104335 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104334 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104050 (The Academy LMS WordPress plugin before 4.0.0 does not verify that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104049 (The Academy LMS WordPress plugin before 4.0.0 does not verify course ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104048 (A flaw was found in SSSD. In trust-enabled identity management environ ...)
TODO: check
CVE-2026-104047 (A flaw was found in SSSD. When configured to use Microsoft Entra ID, s ...)
@@ -397,113 +397,113 @@ CVE-2026-103869 (A flaw was found in pulp-ansible's bearer-token refresh for col
CVE-2026-103868 (A flaw was found in pulp-container when it authenticates to an upstrea ...)
TODO: check
CVE-2026-103681 (The Frontend Dashboard WordPress plugin before 3.0.0 does not perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103670 (When a Gitea Actions run was inserted, older runs in the same workflow ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-103667 (Gitea's container registry served blob downloads with a `Content-Type` ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-103504 (Changing an organization team's permission through the API with only t ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-103378 (The Geliver Ak\u0131ll\u0131 Kargo Pazaryeri WordPress plugin before 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103360 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103323 (The Integration for Epos Now and WooCommerce WordPress plugin before 4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103059 (When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true` ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-103009 (Authorization Bypass Through User-Controlled Key (CWE-639) in Elastics ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103008 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial o ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103007 (Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privile ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103006 (Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial o ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-103005 (Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102478 (In affected versions of Octopus Server, an authenticated user with per ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-102413 (Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102412 (Incorrect Authorization (CWE-863) in Kibana can lead to sensitive info ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102411 (Allocation of Resources Without Limits or Throttling (CWE-770) in Elas ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102410 (Missing Authorization (CWE-862) in Kibana can lead to information disc ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102409 (Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authent ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102408 (Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102407 (Incorrect Authorization (CWE-863) in Elasticsearch can lead to unautho ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102406 (Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana c ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102404 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-102173 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102169 (On affected Arista Wi-Fi access points with Captive Portal enabled, an ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102168 (On affected Arista Wi-Fi access points with Captive Portal enabled, an ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102167 (On affected Arista Wi-Fi access points, a memory corruption vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102165 (On affected Arista Wi-Fi access points, an unauthenticated attacker wi ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102164 (On affected Arista access points configured with VXLAN tunnelling and ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102163 (On affected Arista access points with Wireless Intrusion Prevention Sy ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102162 (On affected Arista Wi-Fi access points with captive portal, or applica ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102161 (An unauthenticated attacker located on an adjacent private network (or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102160 (An operating system (OS) command injection vulnerability in CloudVisio ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102159 (An access-control flaw in the CV-CUE backend may allow an unauthentica ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102158 (Improper validation of selected CloudVision CUE application programmin ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102157 (An insecure direct object reference (IDOR) vulnerability in a CloudVis ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102156 (Improper neutralization of Lightweight Directory Access Protocol (LDAP ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-102155 (An XML External Entity (XXE) injection vulnerability in the WiFi-serve ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101331 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-101329 (IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-101258 (A flaw was found in Ghostscript. When Ghostscript renders a crafted Po ...)
TODO: check
CVE-2026-101158 (A missing input validation vulnerability in the Fileserver upload API ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101157 (A stored cross-site scripting (XSS) vulnerability may allow an unauthe ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101156 (A stored cross-site scripting (XSS) vulnerability may allow an authent ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101155 (An authenticated remote attacker with specific permissions can read or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101154 (An authenticated remote attacker with specific permissions can read or ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101153 (On affected versions of CloudVision Portal (on-premises) or CloudVisio ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101152 (Insufficient validation in the Single Sign-On (SSO) login flow could a ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101151 (Insufficient validation of request in login flow could allow a remote, ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101150 (Insufficient validation of OIDC bearer token configuration could allow ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101149 (Insufficient validation of OIDC SSO provider configuration could allow ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-101029 (Gitea's repository migration and pull mirror egress checks could be by ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matchin ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and grant of a to ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
- xorg-server <unfixed>
- xwayland <unfixed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5a28a29a87fd453f6625bd208068d9b64c4229c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5a28a29a87fd453f6625bd208068d9b64c4229c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/72c0f773/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list