[Git][security-tracker-team/security-tracker][master] Process some NFUs

Thu Oct 8 06:31:11 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0220e831 by Salvatore Bonaccorso at 2026-10-08T07:30:46+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -266,7 +266,7 @@ CVE-2026-107177 (Express Gateway through 1.16.11 contains a hardcoded cryptograp
 CVE-2026-107175 (MISP contains a defect in its event save workflow that prevents the co ...)
 	- misp <itp> (bug #1144317)
 CVE-2026-107174 (A flaw was found in source-to-image. When unpacking archive files, the ...)
-	TODO: check
+	NOT-FOR-US: source-to-image in OpenShift
 CVE-2026-107170 (A flaw was found in m17n-lib. A partial failure during library initial ...)
 	- m17n-lib <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547411
@@ -287,17 +287,17 @@ CVE-2026-107159 (MiniUPnPd through 2.3.11 built with --strict contains a divide-
 	- miniupnpd <unfixed>
 	NOTE: Fixed by: https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
 CVE-2026-107151 (Missing authentication has been found in remote-execution task updates ...)
-	TODO: check
+	NOT-FOR-US: rubygem-smart_proxy_dynflow
 CVE-2026-107125 (A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown ...)
-	TODO: check
+	NOT-FOR-US: XnView
 CVE-2026-107121 (A flaw was found in the SMTP email configuration handling of the keycl ...)
 	TODO: check
 CVE-2026-107104 (This vulnerability exists in the ERP system due to unsafe deserializat ...)
-	TODO: check
+	NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
 CVE-2026-107103 (This vulnerability exists in the ERP system due to insufficient valida ...)
-	TODO: check
+	NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
 CVE-2026-107102 (This vulnerability exists in the ERP system due to improper validation ...)
-	TODO: check
+	NOT-FOR-US: Manacle Technologies Multi-tenant ERP System
 CVE-2026-106580 (ImageMagick is free and open-source software used for editing and mani ...)
 	- imagemagick 8:7.1.2.31+dfsg1-1
 	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-r868-pmwh-fv2c
@@ -419,13 +419,13 @@ CVE-2026-106064 (A heap-based buffer overflow was found in GIMP\u2019s GIF expor
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547446
 	NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
 CVE-2026-106059 (GitAhead through 2.7.1 on macOS contains a command injection vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: GitAhead
 CVE-2026-106058 (GitAhead through 2.7.1 contains an OS command injection vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: GitAhead
 CVE-2026-106057 (patool before 4.0.6 contains an OS command injection vulnerability on  ...)
-	TODO: check
+	NOT-FOR-US: wummel/patool
 CVE-2026-106056 (Rundeck before 6.2.0 contains an OS command injection vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: Rundeck
 CVE-2026-105884 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105876 (Missing Authorization vulnerability in WP Chill Modula Image Gallery m ...)
@@ -437,13 +437,13 @@ CVE-2026-105873 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-105871 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105192 (LMCache multiprocess mode, also called distributed mode, opens an unau ...)
-	TODO: check
+	NOT-FOR-US: LMCache
 CVE-2026-105140 (Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race con ...)
-	TODO: check
+	NOT-FOR-US: Obot
 CVE-2026-105139 (Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: Obot
 CVE-2026-105138 (Obot 0.12.0 before 0.26.2 contains an insufficiently protected credent ...)
-	TODO: check
+	NOT-FOR-US: Obot
 CVE-2026-104393 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104391 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -455,7 +455,7 @@ CVE-2026-104074 (Coturn 4.10.0 contains an uninitialized memory disclosure vulne
 CVE-2026-103668 (An SQL Injection vulnerability exists in the Site Search function of M ...)
 	TODO: check
 CVE-2026-103435 (Claude Code validated that a target file path resided within the proje ...)
-	TODO: check
+	NOT-FOR-US: Claude Code
 CVE-2026-103416 (Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Du ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-103371 (Insertion of Sensitive Information into Log File in Apache Geode Web M ...)
@@ -475,29 +475,29 @@ CVE-2026-102256 (Post-authentication Improper Neutralization of Special Elements
 CVE-2026-102255 (A Pre-authentication SSRF vulnerability exists in the SMA1000 Applianc ...)
 	NOT-FOR-US: SonicWall
 CVE-2026-101886 (Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains  ...)
-	TODO: check
+	NOT-FOR-US: Cisco Jabber for Android (com.cisco.im)
 CVE-2025-70522 (The request handler of Fanvil x7a firmware version 2.6.0.1182 does not ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70521 (The management portal's diagnostic ping tool of Fanvil x7a firmware ve ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70520 (The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does n ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70519 (The device log component of Fanvil x7a firmware version 2.6.0.1182 doe ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70518 (The management portal's diagnostic ping tool of Fanvil x7a firmware ve ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70517 (The request handler of Fanvil x7a firmware version 2.6.0.1182 does not ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70516 (The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does n ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-70515 (The device log component of Fanvil x7a firmware version 2.6.0.1182 doe ...)
-	TODO: check
+	NOT-FOR-US: Fanvil
 CVE-2025-64393 (This vulnerability in Veeam Backup & Replication allows a Backup Viewe ...)
-	TODO: check
+	NOT-FOR-US: Veeam
 CVE-2025-64392 (This vulnerability in Veeam Backup Enterprise Manager allows an attack ...)
-	TODO: check
+	NOT-FOR-US: Veeam
 CVE-2025-64391 (This vulnerability in Veeam Agent for Microsoft Windows allows a low-p ...)
-	TODO: check
+	NOT-FOR-US: Veeam
 CVE-2026-92415 (\u2014 Use of Externally-Controlled Input to Select Classes or Code vu ...)
 	- jackrabbit <unfixed>
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/28
@@ -696,7 +696,7 @@ CVE-2026-73278 (Gitea's OAuth2 and OpenID Connect sign-in paths do not require a
 CVE-2026-70357 (Gitea validates a repository migration hostname against its network al ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-65142 (NVIDIA Model-Optimizer contains a vulnerability where an attacker may  ...)
-	TODO: check
+	NOT-FOR-US: NVIDIA
 CVE-2026-65122 (NVIDIA TensorRT contains a vulnerability where an attacker can cause a ...)
 	NOT-FOR-US: NVIDIA
 CVE-2026-59347 (VMware Workstation and Fusion contain a stack-based buffer-overflow vu ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0220e831b5bfb19b43e401d94deedb5e12f310f5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0220e831b5bfb19b43e401d94deedb5e12f310f5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/6b9be67b/attachment.htm>
