[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 20:15:43 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f9651c9c by security tracker role at 2026-10-07T19:15:36+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,27 +1,27 @@
CVE-2026-97720 (Incorrect implementation of JWT/OAuth authentication in Impala executo ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-97294 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97146 (Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the u ...)
TODO: check
CVE-2026-96408 (A code injection vulnerability exists in the upgrade script of Movable ...)
TODO: check
CVE-2026-96335 (Missing Authorization vulnerability in WPMU DEV Forminator allows Expl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95606 (Deserialization of Untrusted Data vulnerability in Liquid Web / Stella ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95605 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95595 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95534 (Deserialization of Untrusted Data vulnerability in Unlimited Elements ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94670 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94662 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93684 (An SQL user using Impala up to and including version 4.5.2 with only S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-93026 (This vulnerability in Veeam Backup & Replication allows a Backup Viewe ...)
TODO: check
CVE-2026-92543 (Docker Engine classifies a registry hostname as insecure using an any- ...)
@@ -37,15 +37,15 @@ CVE-2026-92531 (Operating system command injection vulnerability in the SVN inte
CVE-2026-92393 (Apache YuniKorn 1.9.0 and earlier does not implement label and user an ...)
TODO: check
CVE-2026-90466 (Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attack ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-89417 (The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88514 (An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obta ...)
TODO: check
CVE-2026-78243 (Apache YuniKorn 1.8.0 and later, if configured with the LDAP group res ...)
TODO: check
CVE-2026-76501 (A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Adm ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76500 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76499 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -55,9 +55,9 @@ CVE-2026-76498 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76488 (A vulnerability in the export policies functionality of Cisco Applicat ...)
TODO: check
CVE-2026-76486 (A vulnerability in the VXLAN Operation, Administration, and Maintenanc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76485 (A vulnerability in the VXLAN Operation, Administration, and Maintenanc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76484 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76483 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -79,7 +79,7 @@ CVE-2026-76468 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76467 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76465 (A vulnerability in the MPLS Operation, Administration, and Maintenance ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76464 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76463 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -109,9 +109,9 @@ CVE-2026-62252 (Homer is open source telecom observability software. Prior to ve
CVE-2026-62251 (Homer is open source telecom observability software. Prior to version ...)
TODO: check
CVE-2026-62179 (PraisonAI is a multi-agent teams system. In `praisonai-platform` prior ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-62176 (PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-5703 (Path traversal vulnerability in the Satel Iberia SenNet Datalogger Ser ...)
TODO: check
CVE-2026-58069 (This vulnerability in Veeam Backup & Replication allows an authenticat ...)
@@ -131,17 +131,17 @@ CVE-2026-45161 (wger is a free, open-source workout and fitness manager. Prior t
CVE-2026-43976 (wger is a free, open-source workout and fitness manager. Prior to vers ...)
TODO: check
CVE-2026-42721 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42720 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42714 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42713 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42710 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42708 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42532 (A path traversal vulnerability exists in the EmailSheet extract_parts ...)
TODO: check
CVE-2026-41958 (A path traversal vulnerability exists in the unzip_http RemoteZipFile ...)
@@ -149,7 +149,7 @@ CVE-2026-41958 (A path traversal vulnerability exists in the unzip_http RemoteZi
CVE-2026-33586 (Authenticated users are able to manipulate both the SMTP envelope \u20 ...)
TODO: check
CVE-2026-27434 (Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-20362 (A vulnerability in the web-based management interface of Cisco Finesse ...)
TODO: check
CVE-2026-20328 (A vulnerability in the web-based management interface of Cisco License ...)
@@ -157,15 +157,15 @@ CVE-2026-20328 (A vulnerability in the web-based management interface of Cisco L
CVE-2026-20321 (A vulnerability in the web-based management API for Cisco Application ...)
TODO: check
CVE-2026-20173 (A vulnerability in Cisco NX-OS Software could allow an unauthenticated ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20038 (A vulnerability in the endpoint group (EPG) contract functionality of ...)
TODO: check
CVE-2026-20032 (A vulnerability in the Python interpreter of Cisco NX-OS Software coul ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-19186 (ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee80215 ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-15894 (The Bluetooth Mesh On-Demand Private Proxy solicitation handler in sub ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-107313 (pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can sen ...)
TODO: check
CVE-2026-107278 (MISP contains a validation flaw in its object synchronization logic. W ...)
@@ -321,7 +321,7 @@ CVE-2026-106556 (Backstage is an open framework for building developer portals.
CVE-2026-106510 (Backstage is an open framework for building developer portals. Prior t ...)
TODO: check
CVE-2026-106164 (In Progress\xae Telerik\xae Document Processing SpreadProcessing libra ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106067 (A heap-based buffer overflow was found in GIMP\u2019s Hot color filter ...)
TODO: check
CVE-2026-106066 (A heap-based buffer overflow was found in GIMP\u2019s raw data export ...)
@@ -339,15 +339,15 @@ CVE-2026-106057 (patool before 4.0.6 contains an OS command injection vulnerabil
CVE-2026-106056 (Rundeck before 6.2.0 contains an OS command injection vulnerability th ...)
TODO: check
CVE-2026-105884 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105876 (Missing Authorization vulnerability in WP Chill Modula Image Gallery m ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105875 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105873 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105871 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105192 (LMCache multiprocess mode, also called distributed mode, opens an unau ...)
TODO: check
CVE-2026-105140 (Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race con ...)
@@ -357,11 +357,11 @@ CVE-2026-105139 (Obot 0.26.0 before 0.26.2 contains an authorization bypass vuln
CVE-2026-105138 (Obot 0.12.0 before 0.26.2 contains an insufficiently protected credent ...)
TODO: check
CVE-2026-104393 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104391 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104390 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104074 (Coturn 4.10.0 contains an uninitialized memory disclosure vulnerabilit ...)
TODO: check
CVE-2026-103668 (An SQL Injection vulnerability exists in the Site Search function of M ...)
@@ -369,23 +369,23 @@ CVE-2026-103668 (An SQL Injection vulnerability exists in the Site Search functi
CVE-2026-103435 (Claude Code validated that a target file path resided within the proje ...)
TODO: check
CVE-2026-103416 (Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Du ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-103371 (Insertion of Sensitive Information into Log File in Apache Geode Web M ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103075 (Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102782 (Joomla Extension - ordasoft.com - Unauthenticated SQL injection in Ord ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102781 (Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102258 (Post-authentication Stored Cross-Site Scripting (XSS) vulnerability ha ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-102257 (A Zip Slip vulnerability in the in the SMA1000 Appliance Management Co ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-102256 (Post-authentication Improper Neutralization of Special Elements used i ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-102255 (A Pre-authentication SSRF vulnerability exists in the SMA1000 Applianc ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-101886 (Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains ...)
TODO: check
CVE-2025-70522 (The request handler of Fanvil x7a firmware version 2.6.0.1182 does not ...)
@@ -6111,7 +6111,7 @@ CVE-2026-101889 (The Prime Mover plugin for WordPress before 2.2.1 contains a pa
CVE-2026-101888 (The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101322 (In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-100517 (Unauthenticated Insecure Direct Object References (IDOR) in Photo Revi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-100514 (Unauthenticated Insecure Direct Object References (IDOR) in REST API L ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f9651c9cf2123fe5c045847fcf0fffda2c8cc4e2
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f9651c9cf2123fe5c045847fcf0fffda2c8cc4e2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/10403e19/attachment.htm>
More information about the debian-security-tracker-commits
mailing list