[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 10 08:46:11 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1c2ccbce by Salvatore Bonaccorso at 2026-10-10T09:45:53+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -69,7 +69,7 @@ CVE-2026-85571 (The Tutor LMS  WordPress plugin before 4.1.1 does not verify tha
 CVE-2026-83526 (The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File U ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-78797 (An issue in iStoreOS istoreos-24.10.7 and before allows a remote attac ...)
-	TODO: check
+	NOT-FOR-US: iStoreOS
 CVE-2026-78068 (The Table Field Add-on for ACF and SCF plugin for WordPress is vulnera ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-77183 (The FooSales \u2013 Point of Sale (POS) for WooCommerce plugin for Wor ...)
@@ -79,15 +79,15 @@ CVE-2026-6723 (The Appointment Booking Calendar \u2014 Simply Schedule Appointme
 CVE-2026-6243 (The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-62376 (Vikunja is an open-source self-hosted task management platform. Versio ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-62367 (Vikunja is an open-source self-hosted task management platform. In ver ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-5727 (The Hello Plus plugin for WordPress is vulnerable to authorization byp ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-5725 (The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cr ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-57458 (Vikunja is an open-source self-hosted task management platform. In ver ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-3717 (The CV Builder \u2013 Professional Resume Builder SaaS plugin for Word ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-22061 (Trident versions v25.02.1 through v26.06.1 are susceptible to a vulner ...)
@@ -127,49 +127,49 @@ CVE-2026-108501 (ZTE Z80 Ultra has a system interface permission verification de
 CVE-2026-108474 (In JetBrains Exposed before 1.5.1 sQL injection was possible via unesc ...)
 	NOT-FOR-US: JetBrains
 CVE-2026-108269 (Remote Attestation TLS Clients provides multi-language utilities for v ...)
-	TODO: check
+	NOT-FOR-US: Remote Attestation TLS Clients (ra-tls-clients)
 CVE-2026-108268 (Enclave OS Virtual runs container workloads inside confidential virtua ...)
-	TODO: check
+	NOT-FOR-US: Enclave OS Virtual
 CVE-2026-108267 (Privasys Go is a maintained fork of the Go programming language that a ...)
-	TODO: check
+	NOT-FOR-US: Privasys Go (fork of Go)
 CVE-2026-108266 (Privasys rustls is a maintained fork of the rustls TLS library that ad ...)
-	TODO: check
+	NOT-FOR-US: Privasys rustls (fork of rustls TLS library)
 CVE-2026-108265 (Enclave OS Mini is a Rust-based runtime for confidential applications  ...)
-	TODO: check
+	NOT-FOR-US: Enclave OS Mini
 CVE-2026-108264 (Wizarr is an advanced user invitation and management system for Jellyf ...)
-	TODO: check
+	NOT-FOR-US: wizarr
 CVE-2026-108263 (Astron Agent is an agentic workflow platform for building and running  ...)
-	TODO: check
+	NOT-FOR-US: Astron Agent
 CVE-2026-108261 (Tina is a headless content management system. Prior to tinacms 3.14.0  ...)
-	TODO: check
+	NOT-FOR-US: Tina CMS
 CVE-2026-108260 (Tina is a headless content management system. Prior to 0.2.1, the tina ...)
-	TODO: check
+	NOT-FOR-US: Tina CMS
 CVE-2026-108259 (Tina is a headless content management system. Prior to 3.0.0, @tinacms ...)
-	TODO: check
+	NOT-FOR-US: Tina CMS
 CVE-2026-108258 (Shiny for Python is a framework for building interactive web applicati ...)
-	TODO: check
+	NOT-FOR-US: Shiny
 CVE-2026-107857 (Mindwtr is a free offline-first task management application for deskto ...)
-	TODO: check
+	NOT-FOR-US: Mindwtr
 CVE-2026-107856 (CiviForm simplifies applications for government benefits programs by r ...)
-	TODO: check
+	NOT-FOR-US: CiviForm
 CVE-2026-107854 (Jexactyl is a customisable game management panel and billing system. F ...)
-	TODO: check
+	NOT-FOR-US: Jexactyl
 CVE-2026-107852 (Jexactyl is a customisable game management panel and billing system. P ...)
-	TODO: check
+	NOT-FOR-US: Jexactyl
 CVE-2026-107851 (Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAc ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107850 (Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bu ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107848 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107845 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107844 (Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7. ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107843 (Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7. ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107842 (Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7. ...)
-	TODO: check
+	NOT-FOR-US: Contao CMS
 CVE-2026-107742 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-107712 (The WP Booking System \u2013 Booking Calendar plugin for WordPress is  ...)
@@ -267,7 +267,7 @@ CVE-2026-102402 (The Team \u2013 Team Members Showcase Plugin plugin for WordPre
 CVE-2026-102401 (The Download Manager plugin for WordPress is vulnerable to Stored Cros ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-101947 (ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell co ...)
-	TODO: check
+	NOT-FOR-US: ExifTool for photo and video
 CVE-2026-101324 (The Fluent Forms \u2013 Customizable Contact Forms, Survey, Quiz, & Co ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-100196 (The LazyLoad Plugin \u2013 Lazy Load Images, Videos, and Iframes plugi ...)
@@ -746,37 +746,37 @@ CVE-2026-105870 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-105318 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105281 (The internal data publisher on openPDC accepts network connections wit ...)
-	TODO: check
+	NOT-FOR-US: openPDC
 CVE-2026-105278 (The published Docker image for openPDC includes a fixed administrative ...)
-	TODO: check
+	NOT-FOR-US: openPDC
 CVE-2026-104635 (Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir ...)
-	TODO: check
+	NOT-FOR-US: elixir-protobuf protobuf
 CVE-2026-104629 (A component loading mechanism in openPDC and openHistorian will constr ...)
-	TODO: check
+	NOT-FOR-US: openPDC
 CVE-2026-104392 (Deserialization of Untrusted Data vulnerability in ExpressTech Quiz An ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104117 (A missing authorization check in the illumos IP management daemon (ipm ...)
-	TODO: check
+	NOT-FOR-US: illumos IP management daemon (ipmgmtd)
 CVE-2026-104116 (A missing authorization check in the illumos zones statistics daemon ( ...)
-	TODO: check
+	NOT-FOR-US: illumos zones statistics daemon (zonestatd)
 CVE-2026-104115 (A stack-based buffer overflow in the illumos reparse point daemon (rep ...)
-	TODO: check
+	NOT-FOR-US: illumos reparse point daemon (reparsed)
 CVE-2026-104114 (A NULL pointer dereference in the illumos Network Auto-Magic daemon (n ...)
-	TODO: check
+	NOT-FOR-US: illumos Network Auto-Magic daemon (nwamd)
 CVE-2026-104113 (A double free in the IP management daemon (ipmgmtd) of OmniOS and Smar ...)
-	TODO: check
+	NOT-FOR-US: IP management daemon (ipmgmtd) of OmniOS and SmartOS
 CVE-2026-104112 (A missing release of resources in the illumos name service cache daemo ...)
-	TODO: check
+	NOT-FOR-US: illumos
 CVE-2026-104084 (SmarterMail before build 9777 contains a privilege escalation vulnerab ...)
-	TODO: check
+	NOT-FOR-US: SmarterMail
 CVE-2026-104083 (SmarterMail before build 9777 contains a stored mutation cross-site sc ...)
-	TODO: check
+	NOT-FOR-US: SmarterMail
 CVE-2026-104082 (SmarterMail before build 9777 contains a remote code execution vulnera ...)
-	TODO: check
+	NOT-FOR-US: SmarterMail
 CVE-2026-104081 (KodExplorer before 4.55 contains a path traversal vulnerability in the ...)
-	TODO: check
+	NOT-FOR-US: KodExplorer
 CVE-2026-104079 (Envira Gallery Lite before 1.16.2 contains a missing authorization vul ...)
-	TODO: check
+	NOT-FOR-US: Envira Gallery Lite
 CVE-2026-103413 (Improper input validation vulnerability in Apache Camel Karavan.    Wh ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-103412 (Improper limitation of a pathname to a restricted directory ('path tra ...)
@@ -786,7 +786,7 @@ CVE-2026-103329 (The Super Payments WordPress plugin before 1.43.1 does not prop
 CVE-2026-103220 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
 	NOT-FOR-US: Canva
 CVE-2026-102916 (A reachable assertion in the illumos bhyve instruction emulator allows ...)
-	TODO: check
+	NOT-FOR-US: illumos
 CVE-2026-102554 (Allocation of resources without limits or throttling (CWE-770) during  ...)
 	TODO: check
 CVE-2026-101130 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
@@ -794,9 +794,9 @@ CVE-2026-101130 (The Affinity by Canva application before 3.3.1 (October 2026 re
 CVE-2026-101094 (The Affinity by Canva application before 3.3.1 (October 2026 release)  ...)
 	NOT-FOR-US: Canva
 CVE-2026-101022 (A Modbus connection feature on openPDC accepts a caller-specified dest ...)
-	TODO: check
+	NOT-FOR-US: openPDC
 CVE-2026-100730 (A service console interface on openPDC and openHistorian deserializes  ...)
-	TODO: check
+	NOT-FOR-US: openPDC
 CVE-2026-100227 (Improper Verification of Cryptographic Signature vulnerability in Apac ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2025-61560 (A race condition vulnerability in the SessionManager of CNCF: Cloud Na ...)
@@ -804,7 +804,7 @@ CVE-2025-61560 (A race condition vulnerability in the SessionManager of CNCF: Cl
 CVE-2025-14123 (The Redux Framework plugin for WordPress is vulnerable to privilege es ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2016-20098 (Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a  ...)
-	TODO: check
+	NOT-FOR-US: Moderator Toolbox (reddit-moderator-toolbox)
 CVE-2026-98384 (In the Linux kernel, the following vulnerability has been resolved:  b ...)
 	- linux 7.2.9-1
 	[bookworm] - linux <not-affected> (Vulnerable code not present)
@@ -1539,7 +1539,7 @@ CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics libr
 	NOTE: https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
 	NOTE: Fixed by: https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf (2.9.0)
 CVE-2026-107377 (datamodel-code-generator generates Python data models from schema defi ...)
-	TODO: check
+	NOT-FOR-US: datamodel-code-generator
 CVE-2026-107376 (webonyx graphql-php is a PHP implementation of the GraphQL specificati ...)
 	NOT-FOR-US: webonyx graphql-php
 CVE-2026-107375 (JHipster is a development platform to quickly generate, develop, and d ...)
@@ -1680,7 +1680,7 @@ CVE-2026-106428 (An out-of-bounds read in SCRAM authentication response parsing
 CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click versions prior ...)
 	NOT-FOR-US: HP
 CVE-2026-106126 (A command injection vulnerability in the Active Directory Events Liste ...)
-	TODO: check
+	NOT-FOR-US: Tenable Identity Exposure (SaaS)
 CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not sanitise and ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not perform a ca ...)
@@ -1728,9 +1728,9 @@ CVE-2026-105673 (An unauthenticated denial-of-service vulnerability exists in Ta
 CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypas ...)
 	NOT-FOR-US: TPLink
 CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitiv ...)
-	TODO: check
+	NOT-FOR-US: Docker Sandboxes
 CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential alongside  ...)
-	TODO: check
+	NOT-FOR-US: Docker Sandboxes
 CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP MainWP Child ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105405
@@ -1752,13 +1752,13 @@ CVE-2026-105398
 CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a u ...)
 	NOT-FOR-US: Checkmk
 CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a relative path t ...)
-	TODO: check
+	NOT-FOR-US: Satel Netco Design
 CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored cross si ...)
-	TODO: check
+	NOT-FOR-US: Satel Netco Design
 CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does not cons ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox  ...)
-	TODO: check
+	NOT-FOR-US: Iskratel Innbox GPON ONT devices
 CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -1766,33 +1766,33 @@ CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not respect the sit ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot hMailServer  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-104659 (Missing Host header validation and missing throttling of failed admini ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-104658 (The Linux live-update apply helper (hmailserver-update) of Progressive ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-104634 (Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in S ...)
-	TODO: check
+	NOT-FOR-US: BeamMCP.Server
 CVE-2026-104628 (Satel Netco Design versions prior to v2.1.7 contains an inefficient re ...)
-	TODO: check
+	NOT-FOR-US: Satel Netco Design
 CVE-2026-104078 (Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Obsidian Desktop
 CVE-2026-104077 (Obsidian Desktop before 1.14.0 contains a remote code execution vulner ...)
-	TODO: check
+	NOT-FOR-US: Obsidian Desktop
 CVE-2026-104076 (TVU Networks Receiver/Transceiver devices running firmware before vers ...)
-	TODO: check
+	NOT-FOR-US: TVU Networks Receiver/Transceiver devices
 CVE-2026-104075 (TVU Networks Receiver/Transceiver devices running firmware before vers ...)
-	TODO: check
+	NOT-FOR-US: TVU Networks Receiver/Transceiver devices
 CVE-2026-103663 (Ollama is vulnerable to path traversal in the `/api/pull` endpoint due ...)
 	- ollama <itp> (bug #1094806)
 CVE-2026-103649 (Missing network timeouts in the Linux builds of Progressive Robot hMai ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot hMailServer 6 ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 d ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme Core vill ...)
@@ -1800,9 +1800,9 @@ CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme Co
 CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption routine ( ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption routine ( ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot hMailServer
 CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language installation feature ...)
 	NOT-FOR-US: Joomla
 CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image preview Gridb ...)
@@ -1810,11 +1810,11 @@ CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image previe
 CVE-2026-102368 (Affected Tapo device firmware stores device-specific cryptographic mat ...)
 	NOT-FOR-US: TPLink
 CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in protecte ...)
-	TODO: check
+	NOT-FOR-US: Docker Sandboxes
 CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash allows an act ...)
-	TODO: check
+	NOT-FOR-US: ash-project
 CVE-2026-101024 (Satel Netco Design versions prior to v2.1.7 contains a relative path t ...)
-	TODO: check
+	NOT-FOR-US: Satel Netco Design
 CVE-2026-100197
 	REJECTED
 CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in Account ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2ccbced7a0b49b418e2a0d2b85699ad186408b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2ccbced7a0b49b418e2a0d2b85699ad186408b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/4586ee38/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list