[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 10 20:17:11 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c73f2730 by security tracker role at 2026-10-10T19:16:46+00:00
automatic NOT-FOR-US entries update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,85 +1,85 @@
 CVE-2026-97396 (The Email Marketing for WordPress and WooCommerce \u2013 Retainful plu ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-97340 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-97264 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-97263 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-96765 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGI ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96662 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96653 (The WP Directory Kit plugin for WordPress is vulnerable to time-based  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96563 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96341 (Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator fo ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-96278 (The WP Photo Album Plus plugin for WordPress is vulnerable to Stored C ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-94676 (Deserialization of Untrusted Data vulnerability in Tainacan Community  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-94590 (Improper Verification of Source of a Communication Channel vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-94160 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93951 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93950 (Missing Authorization vulnerability in StylemixThemes Motors motors al ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93949 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93945 (Deserialization of Untrusted Data vulnerability in Axiomthemes Balance ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93944 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Came ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93943 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Conv ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93942 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwel ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93941 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Edem ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93940 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Gree ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93938 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogw ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93937 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygi ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93936 (Deserialization of Untrusted Data vulnerability in ThemeREX Group IPha ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93935 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Let' ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93934 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Part ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93933 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosa ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93932 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Smar ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93931 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Smas ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93930 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Tant ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93929 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Trav ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93927 (Deserialization of Untrusted Data vulnerability in Axiomthemes Veto ve ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-93746 (The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-91136 (The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Rea ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-66435 (Insertion of Sensitive Information Into Sent Data vulnerability in Dev ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-62046 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Gute ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-62045 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Book ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-62044 (Deserialization of Untrusted Data vulnerability in bPlugins Super Vide ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-57806 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-4791 (The PeproDev Ultimate Profile Solutions plugin for WordPress is vulner ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-108600 (open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contain ...)
 	TODO: check
 CVE-2026-108599 (phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerab ...)
@@ -103,7 +103,7 @@ CVE-2026-108591 (InnoShop 0.9.2 contains a local file disclosure vulnerability t
 CVE-2026-108586 (1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect a ...)
 	TODO: check
 CVE-2026-108585 (argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversa ...)
-	TODO: check
+	NOT-FOR-US: Argo CD
 CVE-2026-108583 (zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forger ...)
 	TODO: check
 CVE-2026-108582 (GenOffice through 0.11.505 contains an incorrect permissions vulnerabi ...)
@@ -135,11 +135,11 @@ CVE-2026-108546 (Spotweb through 1.5.8 contains an OS command injection vulnerab
 CVE-2026-108545 (SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulner ...)
 	TODO: check
 CVE-2026-108506 (ZTE Z80 Ultra's system interfaces do not have robust invocation authen ...)
-	TODO: check
+	NOT-FOR-US: ZTE
 CVE-2026-108505 (ZTE Z80 Ultra has a local information disclosure vulnerability. Third- ...)
-	TODO: check
+	NOT-FOR-US: ZTE
 CVE-2026-108504 (ZTE Z80 Ultra has an unauthorized information disclosure vulnerability ...)
-	TODO: check
+	NOT-FOR-US: ZTE
 CVE-2026-108165 (Immich through 3.3.1 contains a missing authorization vulnerability in ...)
 	TODO: check
 CVE-2026-108164 (Open Source Social Network (OSSN) through 10.1 contains an insecure di ...)
@@ -155,35 +155,35 @@ CVE-2026-108115 (Kortix Suna 0.10.7 before 0.13.52 contains a server-side reques
 CVE-2026-108114 (Strapi 5.47.0 through 5.57.0 contains an improper authorization vulner ...)
 	TODO: check
 CVE-2026-107657 (The HivePress \u2013 Business Directory, Listings & Classified Ads Plu ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-106610 (Incorrect Privilege Assignment vulnerability in miniOrange miniorange  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106609 (Missing Authorization vulnerability in Web Impian Bayarcash WooCommerc ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106608 (Incorrect Privilege Assignment vulnerability in Automattic WooCommerce ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106606 (Deserialization of Untrusted Data vulnerability in YITH YITH WooCommer ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106139 (In Progress\xae Kendo UI for Vue (@progress/kendo-vue-charts) starting ...)
-	TODO: check
+	NOT-FOR-US: Progress Software
 CVE-2026-106138 (In Progress\xae KendoReact (@progress/kendo-react-charts) starting wit ...)
-	TODO: check
+	NOT-FOR-US: Progress Software
 CVE-2026-105892 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105889 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-105885 (Deserialization of Untrusted Data vulnerability in 10Web Slider by 10W ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-104803 (The WPCOM Member plugin for WordPress is vulnerable to Authentication  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-104759 (The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGI ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-104728 (The AutomatorWP \u2013 No-Code Workflow Automation, Integration & Webh ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-104722 (The Listdom: AI-powered Business Directory with Classifieds Ads Listin ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-104398 (Deserialization of Untrusted Data vulnerability in VillaTheme AFFI \u2 ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103636 (Out-of-bounds read in the VarOpt union deserialization of Apache DataS ...)
 	TODO: check
 CVE-2026-103635 (Out-of-bounds read in the compact Theta sketch deserialization of Apac ...)
@@ -193,25 +193,25 @@ CVE-2026-103513 (Out-of-bounds read and write in the CPC sketch deserialization
 CVE-2026-103501 (Heap buffer overflow in the HLL sketch deserialization of Apache DataS ...)
 	TODO: check
 CVE-2026-103478 (The Premium Packages \u2013 Sell Digital Products Securely plugin for  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-103357 (Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-c ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103071 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-102774 (The SureDash \u2013 Community, Courses & Member Dashboard plugin for W ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-102388 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-102291 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-101921 (The WPForms \u2013 AI Form Builder for WordPress \u2013 Contact Forms, ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-101920 (The Molongui Authorship \u2013 Author Boxes, Guest Authors & Co-Author ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-100178 (The WPAdverts \u2013 Classifieds Plugin plugin for WordPress is vulner ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-100147 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin fo ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-107794 (ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a ...)
 	- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246012/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c73f2730414d4342f8e561e8447a067a41606ffe

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c73f2730414d4342f8e561e8447a067a41606ffe
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/a0912092/attachment.htm>

More information about the debian-security-tracker-commits mailing list