[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 9 21:22:27 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e0be3f7b by Salvatore Bonaccorso at 2026-10-09T22:21:58+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -210,23 +210,23 @@ CVE-2026-76769 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior
 CVE-2026-75597 (pyLoad is a free and open-source download manager written in Python. P ...)
 	- pyload <itp> (bug #1001980)
 CVE-2026-75353 (OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the ser ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75352 (OpENer v2.3/commit 76b95cf, contains an integer underflow in the serve ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75351 (OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the serv ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75350 (EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer ov ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75349 (EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an ou ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75348 (An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2. ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75347 (EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an e ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75346 (An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2. ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-75345 (OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the u ...)
-	TODO: check
+	NOT-FOR-US: OpENer
 CVE-2026-73179 (Improper enforcement of single-use authorization code semantics in the ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-71884 (In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR  ...)
@@ -254,7 +254,7 @@ CVE-2026-62026 (Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow
 CVE-2026-55797 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2026-4264 (Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platf ...)
-	TODO: check
+	NOT-FOR-US: BeeTienda e-commerce platform
 CVE-2026-48484 (pyLoad is a free and open-source download manager written in Python. P ...)
 	- pyload <itp> (bug #1001980)
 CVE-2026-42695 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -262,19 +262,19 @@ CVE-2026-42695 (Improper Neutralization of Input During Web Page Generation ('Cr
 CVE-2026-39779 (Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-f ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-39460 (Usernames and passwords, including the default factory credentials, ar ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-39453 (Navigating to a certain URL on the switch\u2019s web server causes the ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-33367 (SNMP can be used to perform administrative actions such as retrieving  ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-33272 (A malicious user with physical access to the device can boot the switc ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-32645 (Default factory credentials with administrative access are enabled and ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-29797 (No authentication is required when updating firmware or bootloader, ma ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-28745 (Usernames and passwords, including the default credentials, are stored ...)
-	TODO: check
+	NOT-FOR-US: Red Lion Controls
 CVE-2026-19575 (The user-mode verification handler for the device_deinit() system call ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-19574 (The ARM64 MMU back-end allocated address space identifiers (ASIDs) for ...)
@@ -288,35 +288,35 @@ CVE-2026-19569 (dynamic_object_create() in kernel/userspace/userspace.c computed
 CVE-2026-15340 (lwIP SMTP client does not check the size of inputs, potentially allowi ...)
 	TODO: check
 CVE-2026-108160 (AstronRPA through 1.1.6 contains a download of code without integrity  ...)
-	TODO: check
+	NOT-FOR-US: AstronRPA
 CVE-2026-108159 (AstronRPA through 1.1.6 contains a cross-site scripting vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: AstronRPA
 CVE-2026-108158 (plugNmeet Server through 2.5.2 contains a path traversal vulnerability ...)
-	TODO: check
+	NOT-FOR-US: plugNmeet Server
 CVE-2026-108157 (Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authent ...)
-	TODO: check
+	NOT-FOR-US: Pingvin Share X
 CVE-2026-108156 (LobsterAI 2026.5.27 through 2026.9.23 contains an external control of  ...)
-	TODO: check
+	NOT-FOR-US: LobsterAI
 CVE-2026-108125 (Improper neutralization of special elements used in an SQL command ('S ...)
-	TODO: check
+	NOT-FOR-US: wp-post-author
 CVE-2026-108124 (Improper neutralization of special elements used in an SQL command ('S ...)
-	TODO: check
+	NOT-FOR-US: wp-post-author
 CVE-2026-108119 (A flaw was found in busybox. The tar applet's deferred link-creation h ...)
 	TODO: check
 CVE-2026-108113 (ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file uploa ...)
-	TODO: check
+	NOT-FOR-US: ILIAS
 CVE-2026-108112 (ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerab ...)
-	TODO: check
+	NOT-FOR-US: ruoyi-ai
 CVE-2026-108111 (ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerab ...)
-	TODO: check
+	NOT-FOR-US: ruoyi-ai
 CVE-2026-108110 (MOVO through 0.2.3 contains an authorization bypass vulnerability in t ...)
-	TODO: check
+	NOT-FOR-US: MOVO
 CVE-2026-108109 (PHPNuxBill through 2025.3.20 contains an account takeover vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: PHPNuxBill
 CVE-2026-108108 (PHPNuxBill through 2025.3.20 contains an authentication bypass vulnera ...)
 	NOT-FOR-US: MikroTik
 CVE-2026-108107 (PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection ...)
-	TODO: check
+	NOT-FOR-US: PHPNuxBill
 CVE-2026-108106 (Xerial snappy-java before 1.1.10.9 contains an unbounded memory alloca ...)
 	TODO: check
 CVE-2026-108105 (Open5GS through 2.8.0 contains a reachable assertion vulnerability in  ...)
@@ -328,9 +328,9 @@ CVE-2026-108103 (Open5GS through 2.8.0 contains a heap out-of-bounds read vulner
 CVE-2026-108102 (Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability ...)
 	TODO: check
 CVE-2026-108101 (HortusFox (hortusfox-web) through 6.3 contains an unrestricted file up ...)
-	TODO: check
+	NOT-FOR-US: HortusFox (hortusfox-web)
 CVE-2026-108100 (HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnera ...)
-	TODO: check
+	NOT-FOR-US: HortusFox (hortusfox-web)
 CVE-2026-108096 (Improper authorization in the query resolvers generated by @aws-amplif ...)
 	NOT-FOR-US: Amazon
 CVE-2026-108093 (A flaw was found in GIMP. The XCF loader processes image-simulation-in ...)
@@ -346,29 +346,29 @@ CVE-2026-107937 (In Apache CXF, the parser for multipart/MTOM attachment part he
 CVE-2026-107935 (A path traversal vulnerability was found in gvproxy, the network forwa ...)
 	TODO: check
 CVE-2026-107841 (pacioli provides least-privilege governance and a governed agent broke ...)
-	TODO: check
+	NOT-FOR-US: pacioli for ERPNext
 CVE-2026-107840 (yopass is a service for securely sharing secrets, passwords, and files ...)
-	TODO: check
+	NOT-FOR-US: yopass
 CVE-2026-107839 (ageLANServer provides a cross-platform web server and launcher for off ...)
-	TODO: check
+	NOT-FOR-US: ageLANServer
 CVE-2026-107838 (RIOT is an open-source microcontroller operating system designed for I ...)
-	TODO: check
+	NOT-FOR-US: RIOT-OS
 CVE-2026-107837 (RIOT is an open-source microcontroller operating system designed for I ...)
-	TODO: check
+	NOT-FOR-US: RIOT-OS
 CVE-2026-107836 (RIOT is an open-source microcontroller operating system designed for I ...)
-	TODO: check
+	NOT-FOR-US: RIOT-OS
 CVE-2026-107835 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-107834 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-107833 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-107826 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-107825 (OWASP Coraza WAF is a golang modsecurity compatible web application fi ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-107824 (x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for  ...)
-	TODO: check
+	NOT-FOR-US: x64dbg-MCP Server
 CVE-2026-107823 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
 	TODO: check
 CVE-2026-107822 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
@@ -376,7 +376,7 @@ CVE-2026-107822 (MariaDB server is a community developed fork of MySQL server. F
 CVE-2026-107821 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
 	TODO: check
 CVE-2026-107820 (x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for  ...)
-	TODO: check
+	NOT-FOR-US: x64dbg-MCP Server
 CVE-2026-107819 (MariaDB Connector/C is a C and C++ client library for connecting appli ...)
 	TODO: check
 CVE-2026-107818 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
@@ -390,29 +390,29 @@ CVE-2026-107815 (MariaDB server is a community developed fork of MySQL server. F
 CVE-2026-107814 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
 	TODO: check
 CVE-2026-107813 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107812 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107811 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107810 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107809 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107808 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107807 (Nginx UI is a web user interface for the Nginx web server. From 2.0.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107806 (Nginx UI is a web user interface for the Nginx web server. From 2.3.8  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107805 (Nginx UI is a web user interface for the Nginx web server. From 2.5.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107804 (Nginx UI is a web user interface for the Nginx web server. From 2.2.0  ...)
-	TODO: check
+	NOT-FOR-US: Nginx UI
 CVE-2026-107803 (ProcessMaker is an open source workflow management software suite. Pri ...)
-	TODO: check
+	NOT-FOR-US: ProcessMaker
 CVE-2026-107785 (Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as ...)
-	TODO: check
+	NOT-FOR-US: Crux Agent
 CVE-2026-107783 (Insertion of sensitive information into log file in AWS Tools for Powe ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107655 (A flaw was found in CUPS. When processing embedded job ticket comments ...)
@@ -1237,21 +1237,21 @@ CVE-2026-107377 (datamodel-code-generator generates Python data models from sche
 CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL specificati ...)
 	NOT-FOR-US: webonyx graphql-php
 CVE-2026-107375 (JHipster is a development platform to quickly generate, develop, and d ...)
-	TODO: check
+	NOT-FOR-US: JHipster
 CVE-2026-107362 (Malcolm file-upload component ships the upstream FilePond PHP server ( ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107361 (The Arkime live capture service (arkime-live) in Malcolm runs with net ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107337 (The Malcolm kiosk Flask application exposes a POST /script_call/<scrip ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107336 (Malcolm's front nginx reverse proxy defines a "Dashboards \u2192 Arkim ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107335 (Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforce ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107334 (Malcolm's nginx Lua role-based access control (RBAC) layer decides whe ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path normalization  ...)
-	TODO: check
+	NOT-FOR-US: CISA Malcolm
 CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection handler in AW ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go Driver ca ...)
@@ -1265,23 +1265,23 @@ CVE-2026-107324 (An integer overflow in BSON value-length handling in the MongoD
 CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent Plugins for AW ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards requests to an u ...)
-	TODO: check
+	NOT-FOR-US: fastify/reply-from
 CVE-2026-107303 (JHipster is a development platform to quickly generate, develop, and d ...)
-	TODO: check
+	NOT-FOR-US: JHipster
 CVE-2026-107302 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107301 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107300 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107299 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107298 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107297 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107296 (msgpack5 is a msgpack v5 implementation for node.js and the browser. P ...)
-	TODO: check
+	NOT-FOR-US: Node msgpack5
 CVE-2026-107295 (Pydantic AI is a Python agent framework for building applications and  ...)
 	NOT-FOR-US: Pydantic AI
 CVE-2026-107294 (Pydantic AI is a Python agent framework for building applications and  ...)
@@ -1303,7 +1303,7 @@ CVE-2026-107287 (Pydantic AI is a Python agent framework for building applicatio
 CVE-2026-107286 (Pydantic AI is a Python agent framework for building applications and  ...)
 	NOT-FOR-US: Pydantic AI
 CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. ...)
-	TODO: check
+	NOT-FOR-US: fastify/jwt
 CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106603 (Authorization Bypass Through User-Controlled Key vulnerability in Grou ...)
@@ -1368,7 +1368,7 @@ CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response parsing
 	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/9655909e15c83149c0fc68e53f38e696bbd23569 (2.4.0)
 	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/57054353fdf79383341de21540a2adab196eb6a4 (1.30.13)
 CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click versions prior ...)
-	TODO: check
+	NOT-FOR-US: HP
 CVE-2026-106126 (A command injection vulnerability in the Active Directory Events Liste ...)
 	TODO: check
 CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not sanitise and ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e0be3f7bda7fdd868f268f9469062749aac73249

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e0be3f7bda7fdd868f268f9469062749aac73249
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/d5211ca4/attachment.htm>

More information about the debian-security-tracker-commits mailing list