[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 9 10:15:17 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
65c188b8 by Salvatore Bonaccorso at 2026-10-09T11:14:27+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -503,11 +503,11 @@ CVE-2026-107703 (@enmaso/node-convert through 1.0.0 contains an OS command injec
CVE-2026-107702 (QloApps through 1.7.0 contains an authorization bypass vulnerability i ...)
NOT-FOR-US: QloApps
CVE-2026-107701 (dot-access through 1.0.0 contains a prototype pollution vulnerability ...)
- TODO: check
+ NOT-FOR-US: dot-access Node.js module
CVE-2026-107700 (dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: dot-access Node.js module
CVE-2026-107699 (ppt2png through 0.0.6 contains an OS command injection vulnerability t ...)
- TODO: check
+ NOT-FOR-US: ppt2png Node.js module
CVE-2026-107698 (FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side requ ...)
TODO: check
CVE-2026-107697 (FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS ...)
@@ -529,15 +529,15 @@ CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper c
CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow e ...)
TODO: check
CVE-2026-107640 (Integrics Enswitch 3.13 through 4.4 contains an authentication bypass ...)
- TODO: check
+ NOT-FOR-US: Integrics Enswitch
CVE-2026-107639 (ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an ...)
- TODO: check
+ NOT-FOR-US: ILIAS
CVE-2026-107638 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper ...)
- TODO: check
+ NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper ...)
- TODO: check
+ NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment va ...)
- TODO: check
+ NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow vulnerability in ...)
TODO: check
CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerabili ...)
@@ -545,59 +545,59 @@ CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read vuln
CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration (DCR) compone ...)
TODO: check
CVE-2026-107615 (An uncontrolled search path element vulnerability in GlavSoft TightVNC ...)
- TODO: check
+ NOT-FOR-US: GlavSoft TightVNC Server for Windows
CVE-2026-107614 (An integer underflow in WinCursorShapeUtils::trimTransparent() in Glav ...)
- TODO: check
+ NOT-FOR-US: GlavSoft TightVNC Server for Windows
CVE-2026-107613 (A NULL pointer dereference vulnerability in the Win8ScreenDriver compo ...)
- TODO: check
+ NOT-FOR-US: GlavSoft TightVNC Server for Windows
CVE-2026-107612 (Incorrect permission assignment in GlavSoft TightVNC Server for Window ...)
- TODO: check
+ NOT-FOR-US: GlavSoft TightVNC Server for Windows
CVE-2026-107611 (An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft Ti ...)
- TODO: check
+ NOT-FOR-US: GlavSoft TightVNC Server for Windows
CVE-2026-107608 (Improper link resolution before file access in the asset bundling outp ...)
NOT-FOR-US: Amazon
CVE-2026-107604 (A flaw was found in the installation provider and client registration ...)
TODO: check
CVE-2026-107589 (Insufficient job validation for service accounts in Jacamar CI prior t ...)
- TODO: check
+ NOT-FOR-US: Jacamar CI
CVE-2026-107587 (Improper certificate validation in the webmail of Progressive Robot hM ...)
- TODO: check
+ NOT-FOR-US: webmail of Progressive Robot hMailServer
CVE-2026-107586 (Uncontrolled eviction in the browser session table of the REST API in ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107585 (Uncontrolled eviction in the pending sign-in tables of the REST API in ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107584 (Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when appl ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107583 (Inefficient algorithmic complexity in the webmail's message view of th ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107582 (Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3. ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107581 (Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IM ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107580 (Inefficient algorithmic complexity in the decoding of message header f ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107579 (Inefficient algorithmic complexity in the bounce and complaint process ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107578 (Improper link resolution and external control of file paths in the adm ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107577 (Inefficient algorithmic complexity and a non-terminating loop in the M ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107576 (Inefficient algorithmic complexity in the inbound DKIM and ARC signatu ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107575 (Inefficient algorithmic complexity in the SPF macro expansion of Progr ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107574 (Inefficient algorithmic complexity in the JSON reader of Progressive R ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107573 (Incorrect default permissions in the Windows installer of Progressive ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107572 (Inefficient complexity in the Sieve filter evaluation of Progressive R ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot hMailServer
CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted Content-Type he ...)
TODO: check
CVE-2026-107565 (A flaw was found in luksmeta. A local attacker with administrative pri ...)
TODO: check
CVE-2026-107510 (An authenticated high privilege user can inject arguments in troublesh ...)
- TODO: check
+ NOT-FOR-US: Infoblox NIOS
CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code + PKCE ve ...)
TODO: check
CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability allows an atta ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/65c188b8652bb7770c3c0c7f192673c52ec2b426
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/65c188b8652bb7770c3c0c7f192673c52ec2b426
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/53574eb2/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list