[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Mon Oct 12 20:43:57 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a8ea7c22 by Salvatore Bonaccorso at 2026-10-12T21:43:07+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -177,17 +177,17 @@ CVE-2026-109359 (Contrast 1.8.0 before 1.24.1 contains an improper verification
 CVE-2026-109358 (Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect pe ...)
 	TODO: check
 CVE-2026-109357 (LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-autho ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109356 (LibreNMS before 26.9.0 contains a missing authorization vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109355 (LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerab ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109354 (LibreNMS before 26.9.0 contains a path traversal vulnerability in nfse ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109353 (LibreNMS before 26.9.0 contains an SQL injection vulnerability that al ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109352 (LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerab ...)
-	TODO: check
+	NOT-FOR-US: LibreNMS
 CVE-2026-109351 (Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory alloca ...)
 	TODO: check
 CVE-2026-109350 (Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerabi ...)
@@ -291,41 +291,41 @@ CVE-2026-109302 (Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.
 CVE-2026-109301 (Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not re ...)
 	NOT-FOR-US: Parse Server
 CVE-2026-109300 (Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scri ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109299 (Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulne ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109298 (Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109297 (Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109296 (Open WebUI before 0.11.4 contains a missing authorization vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109295 (Open WebUI from 0.11.0 before 0.11.4 contains a regular expression den ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109294 (Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109293 (Open WebUI from 0.11.0 before 0.11.4 contains an information disclosur ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109292 (Open WebUI from 0.6.27 before 0.11.4 contains an information disclosur ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109291 (Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting v ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109290 (Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scri ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109289 (Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109288 (Open WebUI before 0.11.4 contains a stored cross-site scripting vulner ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109287 (Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw whe ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109286 (Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message ha ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109285 (Open WebUI from 0.6.0 before 0.11.4 contains an improper access contro ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109284 (Open WebUI from 0.11.0 before 0.11.4 contains an improper authorizatio ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109283 (Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass  ...)
-	TODO: check
+	NOT-FOR-US: Open WebUI
 CVE-2026-109282 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type c ...)
 	TODO: check
 CVE-2026-109281 (ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read  ...)
@@ -377,21 +377,21 @@ CVE-2026-109259 (ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a
 CVE-2026-109258 (ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free v ...)
 	TODO: check
 CVE-2026-109239 (Crawl4AI before 0.9.4 contains a blind server-side request forgery vul ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-109238 (Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vul ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-109237 (Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate byp ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-109229 (SGLang through 0.5.21 contains a denial of service vulnerability that  ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-109228 (SGLang through 0.5.21 contains a resource budget bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-109227 (SGLang through 0.5.21 contains an unbounded memory allocation vulnerab ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-109226 (SGLang through 0.5.21 contains a decompression amplification vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-109225 (SGLang through 0.5.21 contains an unbounded memory allocation vulnerab ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-109222
 	REJECTED
 CVE-2026-109206 (LogicalDOC Community Edition through 9.3 contains a username enumerati ...)
@@ -415,27 +415,27 @@ CVE-2026-109195 (A flaw was found in Quay. An authenticated attacker can access
 CVE-2026-109194 (A flaw was found in Red Hat Quay. The build trigger management applica ...)
 	TODO: check
 CVE-2026-109188 (jshERP through 3.6 contains a missing authorization vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109187 (jshERP through 3.6 contains an information disclosure vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109186 (jshERP through 3.6 contains a mass assignment vulnerability in the Use ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109185 (jshERP through 3.6 contains a missing authorization vulnerability in t ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109184 (jshERP through 3.6 contains an improper authorization vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109183 (jshERP through 3.6 contains an authorization bypass vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109182 (jshERP through 3.6 contains an incorrect authorization vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109181 (jshERP through 3.6 contains an authorization bypass vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109180 (jshERP through 3.6 contains an authorization bypass vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109179 (jshERP through 3.6 contains a missing authorization vulnerability in L ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109178 (jshERP through 3.6 contains a missing authorization vulnerability in L ...)
-	TODO: check
+	NOT-FOR-US: jshERP
 CVE-2026-109177 (MoguBlog through 6.2 contains a broken access control vulnerability th ...)
 	TODO: check
 CVE-2026-109176 (MoguBlog through 6.2 contains an insecure direct object reference vuln ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8ea7c22d181bcfe0b0c96f4f4bcf40a47694e0d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a8ea7c22d181bcfe0b0c96f4f4bcf40a47694e0d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/0167b88b/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list