[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3575493b by Salvatore Bonaccorso at 2026-10-07T10:58:10+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -194,7 +194,7 @@ CVE-2026-43598 (Improper input validation in the AMD ROCm Communication Collecti
 	- rccl <unfixed>
 	NOTE: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6033.html
 CVE-2026-19572 (A security vulnerability has been identified in FlexNet Publisher lmad ...)
-	TODO: check
+	NOT-FOR-US: FlexNet Publisher
 CVE-2026-19396 (A predictable seed in the pseudo-random number generator (PRNG) in the ...)
 	NOT-FOR-US: ASUS
 CVE-2026-19386 (A stack-based buffer overflow in the ASUS router modules allows an aut ...)
@@ -243,7 +243,7 @@ CVE-2026-106552 (In sftp in OpenSSH before 10.6, a server can trigger directory
 	- openssh 1:10.6p1-1
 	NOTE: https://www.openssh.org/releasenotes.html#10.6
 CVE-2026-106550 (Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a De ...)
-	TODO: check
+	NOT-FOR-US: Node convict
 CVE-2026-106547 (A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF ...)
 	- hdf5 <unfixed> (unimportant)
 	NOTE: https://github.com/HDFGroup/hdf5/pull/6529
@@ -295,7 +295,7 @@ CVE-2026-106487 (Backstage is an open framework for building developer portals.
 CVE-2026-106486 (Backstage is an open framework for building developer portals. Prior t ...)
 	NOT-FOR-US: Backstage
 CVE-2026-106471 (A flaw was found in Candlepin. The central authorization filter incorr ...)
-	TODO: check
+	NOT-FOR-US: Candlepin
 CVE-2026-106463 (Backstage is an open framework for building developer portals. Prior t ...)
 	NOT-FOR-US: Backstage
 CVE-2026-106462 (Backstage is an open framework for building developer portals. Prior t ...)
@@ -340,9 +340,9 @@ CVE-2026-106449 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.1
 	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
 	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8 (v1.11.4)
 CVE-2026-106448 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
-	TODO: check
+	NOT-FOR-US: StableLib
 CVE-2026-106447 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
-	TODO: check
+	NOT-FOR-US: StableLib
 CVE-2026-106446 (Handlebars provides the power necessary to let users build semantic te ...)
 	- node-handlebars <unfixed>
 	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
@@ -466,11 +466,11 @@ CVE-2026-104045 (A flaw was found in SSSD. A local user can trigger a Denial of
 	- sssd <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478663
 CVE-2026-103870 (A flaw was found in pulp-rpm when it publishes a distribution tree. Ad ...)
-	TODO: check
+	NOT-FOR-US: Pulp (Red Hat)
 CVE-2026-103869 (A flaw was found in pulp-ansible's bearer-token refresh for collection ...)
-	TODO: check
+	NOT-FOR-US: Pulp (Red Hat)
 CVE-2026-103868 (A flaw was found in pulp-container when it authenticates to an upstrea ...)
-	TODO: check
+	NOT-FOR-US: Pulp (Red Hat)
 CVE-2026-103681 (The Frontend Dashboard WordPress plugin before 3.0.0 does not perform  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-103670 (When a Gitea Actions run was inserted, older runs in the same workflow ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3575493b9a1a30fcf9d214e511229922c4c78849

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3575493b9a1a30fcf9d214e511229922c4c78849
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/6606e9d8/attachment.htm>