[Git][security-tracker-team/security-tracker][master] auto-nfu: Add Canva

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ead47533 by Moritz Muehlenhoff at 2026-10-09T21:25:24+02:00
auto-nfu: Add Canva

Total CVEs from Canva: 12
Total CVEs from Canva with packages assigned: 0

Scope: All Canva products, including open-source software published
and maintained by Canva, as well as vulnerabilities in third-party
software discovered by Canva that are not in another CNA’s scope.

- - - - -


2 changed files:

- data/CVE/list
- data/packages/nfu.yaml


Changes:

=====================================
data/CVE/list
=====================================
@@ -475,15 +475,15 @@ CVE-2026-103412 (Improper limitation of a pathname to a restricted directory ('p
 CVE-2026-103329 (The Super Payments WordPress plugin before 1.43.1 does not properly ve ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-103220 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
-	TODO: check
+	NOT-FOR-US: Canva
 CVE-2026-102916 (A reachable assertion in the illumos bhyve instruction emulator allows ...)
 	TODO: check
 CVE-2026-102554 (Allocation of resources without limits or throttling (CWE-770) during  ...)
 	TODO: check
 CVE-2026-101130 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
-	TODO: check
+	NOT-FOR-US: Canva
 CVE-2026-101094 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
-	TODO: check
+	NOT-FOR-US: Canva
 CVE-2026-101022 (A Modbus connection feature on openPDC accepts a caller-specified dest ...)
 	TODO: check
 CVE-2026-100730 (A service console interface on openPDC and openHistorian deserializes  ...)


=====================================
data/packages/nfu.yaml
=====================================
@@ -69,6 +69,8 @@
   cna: Canon
 - reason: Canon
   cna: Canon_EMEA
+- reason: Canva
+  cna: Canva
 - reason: Carrier Global
   cna: Carrier
 - reason: Cato



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ead475337c84a26c0be7715211fa727565286cbb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ead475337c84a26c0be7715211fa727565286cbb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/08809760/attachment-0001.htm>