[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Oct 12 23:43:01 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57e2ac69 by Moritz Muehlenhoff at 2026-10-13T00:42:14+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -97,11 +97,11 @@ CVE-2026-81856 (Improper Neutralization of Escape, Meta, or Control Sequences vu
CVE-2026-78404 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is vulnerable ...)
NOT-FOR-US: IBM
CVE-2026-77366 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-77364 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-77363 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-75888 (A flaw was found in the OpenShift console. An authenticated console us ...)
NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-6232 (An out-of-bounds write vulnerability in the SPI host command interface ...)
@@ -135,7 +135,7 @@ CVE-2026-109448 (Integer wraparound in psqlODBC SQLBindParameter allows an appli
CVE-2026-109399 (SWUpdate through 2026.05.1 contains an improper certificate validation ...)
TODO: check
CVE-2026-109398 (Gumlet php-image-resize before 3.0.1 contains a denial of service vuln ...)
- TODO: check
+ NOT-FOR-US: php-image-resize
CVE-2026-109397 (Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted fi ...)
TODO: check
CVE-2026-109396 (Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula inje ...)
@@ -149,33 +149,33 @@ CVE-2026-109392 (Pimcore through 2026.3.1 contains a stored cross-site scripting
CVE-2026-109391 (Square Squash through commit e73f280 contains an insecure deserializat ...)
TODO: check
CVE-2026-109390 (AnyDesk before 8.0.3 allows unauthenticated remote attackers to execut ...)
- TODO: check
+ NOT-FOR-US: Anydesk
CVE-2026-109374 (ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerabil ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109373 (ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109372 (ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentic ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109371 (ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerab ...)
- TODO: check
+ NOT-FOR-US: ZITADEL
CVE-2026-109366 (Zebra before 6.4.0 contains an improper integrity validation vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109365 (Zebra before 6.4.0 contains an uncontrolled resource consumption vulne ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109364 (Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109363 (ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions ...)
- TODO: check
+ NOT-FOR-US: Zebra zcash
CVE-2026-109362 (Heym v0.0.5 before v0.0.113 contains a broken access control vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Heym
CVE-2026-109361 (MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerab ...)
- TODO: check
+ NOT-FOR-US: MONAI
CVE-2026-109360 (MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: MONAI
CVE-2026-109359 (Contrast 1.8.0 before 1.24.1 contains an improper verification vulnera ...)
- TODO: check
+ NOT-FOR-US: Edgeless Systems Contrast
CVE-2026-109358 (Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect pe ...)
- TODO: check
+ NOT-FOR-US: Edgeless Systems Contrast
CVE-2026-109357 (LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-autho ...)
NOT-FOR-US: LibreNMS
CVE-2026-109356 (LibreNMS before 26.9.0 contains a missing authorization vulnerability ...)
@@ -227,49 +227,49 @@ CVE-2026-109334 (SurrealDB before 3.3.0 does not check the caller-selected names
CVE-2026-109333 (SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vul ...)
NOT-FOR-US: SurrealDB
CVE-2026-109332 (Network-AI (npm network-ai) before 5.15.2 contains an origin validatio ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109331 (Network-AI from 5.14.0 before 5.15.2 contains a security control bypas ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109330 (Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacki ...)
- TODO: check
+ NOT-FOR-US: Node network-ai
CVE-2026-109329 (Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109328 (Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-s ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109327 (Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a refle ...)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2026-109326 (Grav before 2.1.7 contains an information disclosure vulnerability bec ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109325 (Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulner ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109324 (Grav before 2.1.7 contains a denial of service vulnerability that allo ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109323 (Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109322 (Grav Guestbook plugin before 0.5.2 contains a stored cross-site script ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109321 (Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisi ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109320 (The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improp ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109319 (Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization a ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109318 (Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulner ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109317 (Grav grav-plugin-api before 1.0.36 contains a privilege escalation vul ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109316 (Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing author ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109315 (Grav from 2.0.22 before 2.1.7 contains an information disclosure vulne ...)
- TODO: check
+ NOT-FOR-US: Grav
CVE-2026-109314 (Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosur ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109313 (Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109312 (Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass ...)
- TODO: check
+ NOT-FOR-US: Grav addon
CVE-2026-109311 (vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() ...)
- TODO: check
+ - vllm <itp> (bug #1095237)
CVE-2026-109310 (SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template func ...)
NOT-FOR-US: SiYuan
CVE-2026-109309 (SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulner ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57e2ac692acb8100fe6dfaec84ca21b04e68930b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57e2ac692acb8100fe6dfaec84ca21b04e68930b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/4c25f63a/attachment.htm>
More information about the debian-security-tracker-commits
mailing list