[Git][security-tracker-team/security-tracker][master] Process some more NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5d574438 by Salvatore Bonaccorso at 2026-10-09T18:26:31+02:00
Process some more NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -677,23 +677,23 @@ CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0,
 	NOTE: Fixed by: https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3 (v1.14.0)
 	NOTE: Relates to the mitigation applied for GHSA-r9c8-gcjp-xfwh / CVE-2026-77410
 CVE-2026-107385 (MariaDB Connector/Node.js is used to connect applications developed on ...)
-	TODO: check
+	NOT-FOR-US: MariaDB Connector/Node.js
 CVE-2026-107384 (MariaDB Connector/Node.js is used to connect applications developed on ...)
-	TODO: check
+	NOT-FOR-US: MariaDB Connector/Node.js
 CVE-2026-107383 (MariaDB Connector/Node.js is used to connect applications developed on ...)
-	TODO: check
+	NOT-FOR-US: MariaDB Connector/Node.js
 CVE-2026-107382 (MariaDB Connector/Node.js is used to connect applications developed on ...)
-	TODO: check
+	NOT-FOR-US: MariaDB Connector/Node.js
 CVE-2026-107380 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitiz ...)
-	TODO: check
+	NOT-FOR-US: darylldoyle svg-sanitizer
 CVE-2026-107379 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitiz ...)
-	TODO: check
+	NOT-FOR-US: darylldoyle svg-sanitizer
 CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Pr ...)
 	TODO: check
 CVE-2026-107377 (datamodel-code-generator generates Python data models from schema defi ...)
 	TODO: check
 CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL specificati ...)
-	TODO: check
+	NOT-FOR-US: webonyx graphql-php
 CVE-2026-107375 (JHipster is a development platform to quickly generate, develop, and d ...)
 	TODO: check
 CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP server ( ...)
@@ -812,11 +812,11 @@ CVE-2026-105886 (Missing Authorization vulnerability in BdThemes Ultimate Post K
 CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce Product B ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object reference vul ...)
-	TODO: check
+	NOT-FOR-US: EspoCRM
 CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: EspoCRM
 CVE-2026-105831 (EspoCRM before 10.0.6 contains a stored HTML injection vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: EspoCRM
 CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time d ...)
 	TODO: check
 CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scrip ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d5744383f24e07c0fb9bf35743e0b6cf0750cc5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d5744383f24e07c0fb9bf35743e0b6cf0750cc5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/360cdd5a/attachment.htm>