[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 12 06:40:47 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
63748afb by Salvatore Bonaccorso at 2026-10-12T07:40:26+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-59508 (Improper neutralization of special elements used in an SQL command ('S ...)
- TODO: check
+ NOT-FOR-US: Interuse i-Bos
CVE-2026-19935 (The Bluetooth LE host queues received L2CAP connection-oriented channe ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19740 (The Link Layer Control Procedure (LLCP) implementation of the Zephyr s ...)
@@ -23,9 +23,9 @@ CVE-2026-19576 (The Goodix GT9xx input driver in drivers/input/input_gt911.c rea
CVE-2026-18418 (The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-108925 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
- TODO: check
+ NOT-FOR-US: NetBackup Administration Console web interface
CVE-2026-108913 (omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via ...)
- TODO: check
+ NOT-FOR-US: omarchy
CVE-2026-108905 (pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded ...)
NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-108904 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an informati ...)
@@ -83,147 +83,147 @@ CVE-2026-108867 (JeecgBoot through 3.9.5 contains a missing authorization vulner
CVE-2026-108866 (JeecgBoot through 3.9.5 contains a missing authorization vulnerability ...)
NOT-FOR-US: JeecgBoot
CVE-2026-108865 (AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: AmoyLab Unla
CVE-2026-108864 (iFlytek Astron Agent through 1.1.2 contains an insecure direct object ...)
- TODO: check
+ NOT-FOR-US: iFlytek Astron Agent
CVE-2026-108863 (Katanemo Plano through 0.4.37 contains a missing authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Katanemo Plano
CVE-2026-108862 (APIPark through 1.9.7-beta contains an insecure direct object referenc ...)
- TODO: check
+ NOT-FOR-US: APIPark
CVE-2026-108861 (Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulner ...)
- TODO: check
+ NOT-FOR-US: Odoo MCP
CVE-2026-108860 (BotSharp through 5.2.0 contains an authentication bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: BotSharp
CVE-2026-108859 (mcp-go through 1.2.1 contains a denial of service vulnerability in Str ...)
- TODO: check
+ NOT-FOR-US: mcp-go
CVE-2026-108858 (Predibase LoRAX through 0.12.1 contains a sensitive information exposu ...)
- TODO: check
+ NOT-FOR-US: Predibase LoRAX
CVE-2026-108857 (Hugging Face Text Embeddings Inference through 1.9.4 contains a cleart ...)
- TODO: check
+ NOT-FOR-US: Hugging Face Text Embeddings Inference
CVE-2026-108856 (UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: UnicomAI Wanwu
CVE-2026-108855 (UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerab ...)
- TODO: check
+ NOT-FOR-US: UnicomAI Wanwu
CVE-2026-108854 (Wanwu before 0.6.3 contains an insecure direct object reference vulner ...)
- TODO: check
+ NOT-FOR-US: UnicomAI Wanwu
CVE-2026-108853 (UnicomAI Wanwu before 0.6.3 contains an insecure direct object referen ...)
- TODO: check
+ NOT-FOR-US: UnicomAI Wanwu
CVE-2026-108852 (Deep Chat through 2.5.1 contains a cross-site scripting vulnerability ...)
- TODO: check
+ NOT-FOR-US: Deep Chat
CVE-2026-108851 (phpMyFAQ through 4.1.10 contains a missing authorization vulnerability ...)
NOT-FOR-US: phpMyFAQ
CVE-2026-108850 (Company Research Agent through 2.2.0 contains a server-side request fo ...)
- TODO: check
+ NOT-FOR-US: Company Research Agent
CVE-2026-108839 (thClaws through 0.141.0 contains a link-following vulnerability in the ...)
- TODO: check
+ NOT-FOR-US: thClaws
CVE-2026-108768 (A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affec ...)
- TODO: check
+ NOT-FOR-US: zhayujie CowAgent
CVE-2026-108760 (LlamaFarm through 0.0.34 contains an insecure default configuration th ...)
- TODO: check
+ NOT-FOR-US: LlamaFarm
CVE-2026-108759 (mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability ...)
- TODO: check
+ NOT-FOR-US: mistral.rs
CVE-2026-108758 (Easy!Appointments through 1.6.0 contains an authorization bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Easy!Appointments
CVE-2026-108757 (Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missi ...)
NOT-FOR-US: OpenClaw
CVE-2026-108756 (Abilityai Trinity through 0.9.5 contains a missing authorization vulne ...)
- TODO: check
+ NOT-FOR-US: Abilityai Trinity
CVE-2026-108755 (Hatchet through 0.110.5 contains an allocation of resources without li ...)
- TODO: check
+ NOT-FOR-US: Hatchet
CVE-2026-108754 (GPT-Load through 1.4.11 contains a cleartext logging vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: GPT-Load
CVE-2026-108753 (Agnaistic agnai through 1.0.555 contains a hard-coded credentials vuln ...)
- TODO: check
+ NOT-FOR-US: Agnaistic agnai
CVE-2026-108752 (JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ...)
TODO: check
CVE-2026-108751 (MoAI-ADK through 3.1.2 contains an improper link resolution vulnerabil ...)
- TODO: check
+ NOT-FOR-US: MoAI-ADK
CVE-2026-108750 (OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerab ...)
- TODO: check
+ NOT-FOR-US: OpenDocMan
CVE-2026-108749 (docling-serve 1.14.0 through 1.36.0 contains a missing authentication ...)
- TODO: check
+ NOT-FOR-US: docling-serve
CVE-2026-108748 (Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of ...)
- TODO: check
+ NOT-FOR-US: Quarkus LangChain4j
CVE-2026-108747 (Lightdash through 2.556.0 contains an authorization bypass vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Lightdash
CVE-2026-108746 (Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Vearch
CVE-2026-108745 (CloudBeaver through 25.3.5 contains a missing authorization vulnerabil ...)
- TODO: check
+ NOT-FOR-US: CloudBeaver
CVE-2026-108744 (pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnera ...)
- TODO: check
+ NOT-FOR-US: pbi-cli
CVE-2026-108742 (CloudBeaver through 25.3.5 contains a missing authorization vulnerabil ...)
- TODO: check
+ NOT-FOR-US: CloudBeaver
CVE-2026-108741 (Shepherd (shepherd-ai) through 0.3.1 contains a server-side request fo ...)
- TODO: check
+ NOT-FOR-US: Shepherd (shepherd-ai)
CVE-2026-108740 (GoatCounter through 2.7.0 contains a mass assignment privilege escalat ...)
- TODO: check
+ NOT-FOR-US: GoatCounter
CVE-2026-108739 (OpenAgents Workspace backend through launcher-v1.0.17 contains an info ...)
- TODO: check
+ NOT-FOR-US: OpenAgents
CVE-2026-108738 (Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulne ...)
- TODO: check
+ NOT-FOR-US: Traccar
CVE-2026-108737 (Traccar through 6.16.0 contains a weak password recovery vulnerability ...)
- TODO: check
+ NOT-FOR-US: Traccar
CVE-2026-108736 (Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Speedtest Tracker
CVE-2026-108735 (Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vu ...)
TODO: check
CVE-2026-108734 (Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vuln ...)
- TODO: check
+ NOT-FOR-US: Frappe CRM
CVE-2026-108733 (Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases ...)
- TODO: check
+ NOT-FOR-US: Frappe HR (hrms)
CVE-2026-108732 (Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases ...)
- TODO: check
+ NOT-FOR-US: Frappe HR (hrms)
CVE-2026-108731 (Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Raven (not the same as src:raven)
CVE-2026-108730 (Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Raven (not the same as src:raven)
CVE-2026-108729 (Corteza through 2024.9.10 contains an incorrect authorization vulnerab ...)
- TODO: check
+ NOT-FOR-US: Corteza
CVE-2026-108728 (Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnera ...)
- TODO: check
+ NOT-FOR-US: Flyte
CVE-2026-108727 (EdgeEver through 1.108.0 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: EdgeEver
CVE-2026-108726 (GLPI through 12.0.0 contains a missing authorization vulnerability in ...)
TODO: check
CVE-2026-108725 (Cheshire Cat AI core through 2.0.23 contains a stored cross-site scrip ...)
- TODO: check
+ NOT-FOR-US: Cheshire Cat AI
CVE-2026-108724 (Sylius through 2.3.0 contains an authorization bypass vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Sylius
CVE-2026-108723 (answer-me-with-html through 0.5.0 contains a link following vulnerabil ...)
- TODO: check
+ NOT-FOR-US: answer-me-with-html
CVE-2026-108722 (open-computer-use through commit 610bac8 contains a stored cross-site ...)
- TODO: check
+ NOT-FOR-US: open-computer-use
CVE-2026-108721 (Open Computer Use through 1.0.0 on macOS contains an improper case sen ...)
- TODO: check
+ NOT-FOR-US: open-computer-use
CVE-2026-108720 (phpIPAM through 1.8.3 contains a missing authorization vulnerability t ...)
TODO: check
CVE-2026-108719 (LLMGateway through 1.20.0 contains a blind server-side request forgery ...)
- TODO: check
+ NOT-FOR-US: LLMGateway
CVE-2026-108718 (Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Rill
CVE-2026-108717 (Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vuln ...)
- TODO: check
+ NOT-FOR-US: Combodo iTop
CVE-2026-108716 (mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vuln ...)
- TODO: check
+ NOT-FOR-US: mcp-remote
CVE-2026-108715 (LibreNMS through 26.9.1.1 contains an authorization bypass vulnerabili ...)
- TODO: check
+ NOT-FOR-US: LibreNMS
CVE-2026-108714 (MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocati ...)
- TODO: check
+ NOT-FOR-US: MCP Kotlin SDK
CVE-2026-108713 (SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing auth ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-108712 (SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vu ...)
- TODO: check
+ NOT-FOR-US: SuiteCRM
CVE-2026-108711 (Plastic Labs Honcho through 3.3.0 contains an incorrect authorization ...)
- TODO: check
+ NOT-FOR-US: Plastic Labs Honcho
CVE-2026-108710 (NornicDB through 1.4.1 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: NornicDB
CVE-2026-108699 (hyper-mcp through 0.8.3 contains an improper signature verification vu ...)
- TODO: check
+ NOT-FOR-US: hyper-mcp
CVE-2026-108698 (hyper-mcp through 0.8.3 contains a signature verification bypass vulne ...)
- TODO: check
+ NOT-FOR-US: hyper-mcp
CVE-2026-108697 (CoreShop through 2026.2.2 contains a missing authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: CoreShop
CVE-2026-108684 (A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affe ...)
TODO: check
CVE-2026-108683 (A security vulnerability has been detected in zhayujie CowAgent up to ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/63748afb28638c1208ec0daddf94cf40d7e15718
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/63748afb28638c1208ec0daddf94cf40d7e15718
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/9e52f28c/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list