[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 13 20:16:02 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5a91a368 by security tracker role at 2026-10-13T19:15:54+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,9 +1,9 @@
CVE-2026-9218 (Insufficient input validation vulnerability in time server (NTP) setti ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-97334 (The network messaging layer contained improper handling of highly comp ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-97333 (QAPI contained a stack-based buffer overflow affecting service availab ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-96535 (Cross-Site Scripting on the YouMind portal, specifically in the avatar ...)
TODO: check
CVE-2026-96299 (A security issue was discovered in MongoDB mongos (the sharded cluster ...)
@@ -11,13 +11,13 @@ CVE-2026-96299 (A security issue was discovered in MongoDB mongos (the sharded c
CVE-2026-96297 (Use of freed memory in the aggregation feature of MongoDB Server can c ...)
TODO: check
CVE-2026-95680 (IBM WebSphere Application Server 8.5, and 9.0 could allow an authentic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-95631 (Adobe Commerce is affected by an Improper Input Validation vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-95630 (Adobe Commerce is affected by an Improper Input Validation vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-95502 (A Git server that Grafana's Git Sync (provisioning) is configured to u ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-95127 (An issue in libass v.0.17.5 allows a remote attacker to cause a denial ...)
TODO: check
CVE-2026-95124 (Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows ...)
@@ -35,61 +35,61 @@ CVE-2026-95114 (libwebsockets contains an out-of-bounds read vulnerability in th
CVE-2026-94410 (A low privileged remote attacker is able to view a list of roles that ...)
TODO: check
CVE-2026-93907 (IBM WebSphere Application Server 8.5, and 9.0 could allow a remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93347 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-93346 (Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-93294 (A user with query access to an Azure Monitor data source can use its r ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-92922 (Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92911 (Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92910 (Adobe Commerce is affected by an Incorrect Authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92909 (Adobe Commerce is affected by an Incorrect Authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92908 (Adobe Commerce is affected by an Incorrect Authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92892 (Potential arbitrary code execution, under specific configurations.)
TODO: check
CVE-2026-92464 (Adobe Commerce is affected by an Improper Input Validation vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-92088 (Improper handling of undefined values vulnerability in upKeeper Soluti ...)
- TODO: check
+ NOT-FOR-US: upKeeper Solutions
CVE-2026-91013 (Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-89309 (Vulnerability in tbc. This issue affects tbc: before 1.)
TODO: check
CVE-2026-89279 (Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology ...)
TODO: check
CVE-2026-89208 (A vulnerability has been identified in Capital Embedded AR Classic 431 ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89206 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89205 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89204 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89203 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89202 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89201 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89200 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89199 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89198 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89197 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89196 (A vulnerability has been identified in RUGGEDCOM CROSSBOW (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-89097 (The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88838 (A flaw was found in BusyBox's mount utility. A non-root user can bypas ...)
TODO: check
CVE-2026-88836
@@ -105,9 +105,9 @@ CVE-2026-85747 (Distribution is a toolkit to pack, ship, store, and deliver cont
CVE-2026-85733 (FrankenPHP is a modern application server for PHP. Prior to 1.12.5, th ...)
TODO: check
CVE-2026-85115 (A vulnerability has been identified in .NET Client Library for SIMATIC ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-85114 (A vulnerability has been identified in .NET Client Library for SIMATIC ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-82416 (FrankenPHP is a modern application server for PHP. Prior to 1.12.5, Fr ...)
TODO: check
CVE-2026-81507 (ESF-IDF is the Espressif Internet of Things (IOT) Development Framewor ...)
@@ -117,11 +117,11 @@ CVE-2026-78802 (An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Ban
CVE-2026-78799 (Directory Traversal vulnerability in Quanxun Huiju Network Technology ...)
TODO: check
CVE-2026-78557 (A vulnerability has been identified in Industrial Edge App Publisher ( ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-78556 (A vulnerability has been identified in Industrial Edge App Publisher ( ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-77459 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
- TODO: check
+ NOT-FOR-US: Argo CD
CVE-2026-77375 (SFTPGo is an open source, event-driven file transfer solution. Prior t ...)
TODO: check
CVE-2026-77362 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
@@ -129,59 +129,59 @@ CVE-2026-77362 (obsidian-tc is a governed, agent-ready Model Context Protocol se
CVE-2026-77361 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
TODO: check
CVE-2026-77100 (MediaAgent contained a heap-based buffer overflow issue affecting serv ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77099 (CVFS contained an input validation issue affecting command execution. ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77096 (CVFS contained a missing authentication condition affecting command ex ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77095 (CvFWD contained a null pointer dereference affecting service availabil ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77094 (CvFWD contained an out-of-bounds write affecting service availability. ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77093 (CvFWD contained an integer overflow affecting service availability. S ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-77090 (CVFS contained an XML external entity (XXE) reference handling issue a ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-75120 (The OpenText\u2122 (EnCase SAFE Agents) component utilized by OpenText ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-74047 (Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vuln ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74045 (Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74043 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74041 (Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch betwee ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74040 (Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file over ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74037 (Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74036 (Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulner ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74035 (Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypa ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74034 (Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_a ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74033 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74032 (Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulner ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74031 (Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-74030 (Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias exp ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-72895 (A vulnerability has been identified in SIMATIC IPC BX-21A (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-69227 (A flaw in Portal for ArcGIS allows unauthenticated access to certain / ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-69226 (A flaw in Portal for ArcGIS allows unauthenticated users to create new ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-67456 (NVIDIA Warp contains a vulnerability where an attacker could cause a h ...)
TODO: check
CVE-2026-67165 (HCL Connections is vulnerable to a cross-site scripting attack where a ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-66057 (Frappe is a full-stack web application framework. Prior to 15.116.0 an ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-65200 (The openUBMC device-management process parses PLDM-over-MCTP and NCSI- ...)
TODO: check
CVE-2026-65199 (openUBMC assigns the full privilege set to pseudo-identities represent ...)
@@ -191,61 +191,61 @@ CVE-2026-65198 (Huawei's openUBMC ships a default SNMPv3 USM key that uses one v
CVE-2026-65197 (H3C HDM Family-A verifies the RSA signature of a firmware image agains ...)
TODO: check
CVE-2026-65180 (NVIDIA Megatron-LM contains a vulnerability in checkpoint loading wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65173 (NVIDIA AIStore for Linux contains a missing authentication vulnerabili ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65172 (NVIDIA AIStore for Linux and Kubernetes contains a missing authorizati ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65170 (NVIDIA AIStore for Linux contains a vulnerability in the experimental ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65164 (NVIDIA AIStore for Linux contains a path traversal vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65162 (NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Ku ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65161 (NVIDIA AIStore for Linux contains a vulnerability in the Promote API w ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65150 (NVIDIA DALI contains a vulnerability where an attacker could cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65149 (NVIDIA DALI contains a vulnerability where an attacker could cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65148 (NVIDIA DALI contains a vulnerability where an attacker could cause a s ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65147 (NVIDIA DALI contains a vulnerability where an attacker could cause an ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65141 (NVIDIA Isaac Lab contains a vulnerability where an attacker could caus ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65131 (NVIDIA NVSentinel for Linux contains a vulnerability in the platform-c ...)
TODO: check
CVE-2026-65110 (NVIDIA Megatron-LM contains a vulnerability in checkpoint loading wher ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65104 (NVIDIA Megatron-LM for all platforms contains a vulnerability in infer ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65103 (NVIDIA AIStore for Linux contains a path traversal vulnerability in th ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-65101 (NVIDIA AIStore for Linux contains a vulnerability in the distributed s ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-63357 (Affected devices do not properly sanitize calculated signal data conta ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63356 (Affected devices do not properly sanitize calculated signal names cont ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63355 (Affected devices do not properly sanitize signal names contained in im ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63354 (Affected devices do not properly validate and sanitize visual marker d ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63353 (Affected devices do not properly sanitize comment fields contained in ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63352 (Affected devices do not properly sanitize calculated signal data conta ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63351 (Affected devices do not properly validate and sanitize visual properti ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63350 (Affected devices do not properly restrict executable content contained ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-63316 (A SQL injection vulnerability has been identified in Payload CMS. Impr ...)
TODO: check
CVE-2026-59241 (A vulnerability has been identified in SIMATIC WinCC V7.5 (All version ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-55823 (Frappe is a full-stack web application framework. Prior to 16.23.0, th ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-55695 (FearlessCMS is a flat-file content management system centered on simpl ...)
TODO: check
CVE-2026-55675 (The Salty documentation repository builds and deploys the docs.saltbox ...)
@@ -273,11 +273,11 @@ CVE-2026-53711 (MCP Context Forge provides an MCP Admin UI for managing gateway
CVE-2026-53709 (MCP Context Forge is an MCP gateway and administrative platform. Prior ...)
TODO: check
CVE-2026-53562 (Improper link resolution before file access ('link following') vulnera ...)
- TODO: check
+ NOT-FOR-US: Citrix
CVE-2026-53420 (Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-53418 (Improper Authorization in Handler for Custom URL Scheme in Zoom Workpl ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-52394 (DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted in ...)
TODO: check
CVE-2026-4869 (A potential privilege escalation issue was identified in InstallShield ...)
@@ -287,43 +287,43 @@ CVE-2026-49265 (OAuthLib is an implementation of the OAuth request-signing logic
CVE-2026-49264 (OAuthLib is an implementation of the OAuth request-signing logic for P ...)
TODO: check
CVE-2026-44415 (Affected systems do not properly restrict access to internal APIs and ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-44414 (A vulnerability has been identified in Industrial Edge Cloud Device (I ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-37107 (An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privile ...)
TODO: check
CVE-2026-33374 (The Prometheus rule conversion API endpoints in Grafana do not limit r ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-23707 (An Improper Neutralization of Special Elements used in an SQL Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-23706 (An Improper Neutralization of Special Elements used in an SQL Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-23705 (An Improper Neutralization of Special Elements used in an SQL Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-19940 (The Bluetooth Classic Hands-Free Profile Audio Gateway implementation ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19939 (The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIME ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-18228 (HyperScale contained a path traversal issue affecting information disc ...)
- TODO: check
+ NOT-FOR-US: Commvault
CVE-2026-15577 (A user or service account with read-only access to Git Sync (provision ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-15399 (The Animated Number Counters plugin for WordPress is vulnerable to gen ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14308 (Zohocorp ManageEngine Malware Protection Plus versionsbefore 1.0.64.12 ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-13138 (Client-Side Enforcement of Server-Side Security vulnerability in Divas ...)
TODO: check
CVE-2026-12656 (A denial-of-service security issue exists in the affected product and ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2026-12655 (A security issue exists within 1732E ArmorBlock\xae I/O, where an unau ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2026-11732 (An insufficient input validation vulnerability in the website blocking ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-11731 (An authentication bypass vulnerability in the listed NETGEAR RAX serie ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-11730 (Insufficient session randomness vulnerability in the listed NETGEAR Ex ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-110249 (A malicious, compromised, or MITM-controlled Exchange server can retur ...)
TODO: check
CVE-2026-110247 (Several buffer-growth sites in libmime performed size arithmetic in 32 ...)
@@ -473,7 +473,7 @@ CVE-2026-110036 (A flaw was found in device-mapper-persistent-data. A local atta
CVE-2026-110025 (A flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This is ...)
TODO: check
CVE-2026-10759 (A flaw in Portal for ArcGIS could allow LDAP injection through adminis ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-109976 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
TODO: check
CVE-2026-109967 (yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulner ...)
@@ -503,7 +503,7 @@ CVE-2026-109956 (NLTK through 3.10.3 contains a path traversal vulnerability in
CVE-2026-109955 (Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerabi ...)
TODO: check
CVE-2026-109954 (Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 share ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-109953 (FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected crede ...)
TODO: check
CVE-2026-109952 (The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selecte ...)
@@ -537,11 +537,11 @@ CVE-2026-109939 (FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereferenc
CVE-2026-109938 (Positive mapped-video coordinates overflow and abort FreeRDP clients A ...)
TODO: check
CVE-2026-109898 (Missing Authorization vulnerability in Arraytics WP Event Solution wp- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109896 (Missing Authorization vulnerability in WP Chill Download Monitor integ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109890 (Missing Authorization vulnerability in LeapWorx Premium Addons for Ele ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109854 (A flaw was found in m17n-lib. An attacker who supplies crafted input t ...)
TODO: check
CVE-2026-109833 (A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterpr ...)
@@ -553,19 +553,19 @@ CVE-2026-109828 (A vulnerability was found in libsndfile up to 1.2.2. This issue
CVE-2026-109827 (A vulnerability has been found in GPAC up to 26.07.0. This vulnerabili ...)
TODO: check
CVE-2026-109703 (Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109699 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109697 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109696 (Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109691 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109687 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109684 (Missing Authorization vulnerability in TMS Amelia ameliabooking allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109680 (FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in f ...)
TODO: check
CVE-2026-109679 (FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference ...)
@@ -577,13 +577,13 @@ CVE-2026-109677 (FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bound
CVE-2026-109676 (FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulne ...)
TODO: check
CVE-2026-109620 (A vulnerability has been found in SourceCodester Online Reviewer Syste ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109607 (A flaw has been found in SourceCodester Online Exam System 1.0. Affect ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109606 (A vulnerability was detected in SourceCodester Art Gallery Management ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109605 (A security vulnerability has been detected in SourceCodester Simple Ca ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-109526 (A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. T ...)
TODO: check
CVE-2026-109525 (A vulnerability was identified in girishsaraf Online-Appointment-Booki ...)
@@ -605,7 +605,7 @@ CVE-2026-109429 (Mistral Vibe before 2.25.4 contains a command permission gate b
CVE-2026-109428 (Mistral Vibe before 2.25.5 contains a permission validation bypass vul ...)
TODO: check
CVE-2026-109412 (An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allow ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-109410 (A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The i ...)
TODO: check
CVE-2026-109409 (A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affect ...)
@@ -627,11 +627,11 @@ CVE-2026-109190 (A vulnerability has been found in conductor-oss conductor 3.31.
CVE-2026-109189 (A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. ...)
TODO: check
CVE-2026-109162 (Forms using FileUpload or ImageUpload elements with a custom saveToFil ...)
- TODO: check
+ NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-109160 (A vulnerability was determined in PublicCMS up to 5.202608.a. Affected ...)
TODO: check
CVE-2026-109157 (A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by ...)
- TODO: check
+ NOT-FOR-US: TRENDnet
CVE-2026-109156 (A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affec ...)
TODO: check
CVE-2026-109155 (A flaw has been found in DeepPavlov up to 1.7.0. This impacts the func ...)
@@ -653,29 +653,29 @@ CVE-2026-109115 (A vulnerability was found in AdithyaYelloju Restaurant-Manageme
CVE-2026-109114 (A vulnerability has been found in AdithyaYelloju Restaurant-Management ...)
TODO: check
CVE-2026-109110 (A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affect ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109109 (A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vul ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109108 (A security vulnerability has been detected in Wavlink WL-WN530BE1-A 25 ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-109107 (A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-108496 (Missing Authorization vulnerability in WP User Manager WP User Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108495 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108493 (Missing Authorization vulnerability in Karol\xedna Vysko\u010dilov\xe1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108492 (Missing Authorization vulnerability in Fullworks Plugins Quick Paypal ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108490 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108489 (Insertion of Sensitive Information Into Sent Data vulnerability in Plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108488 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108487 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108385 (dataclasses-avroschema generates Avro schemas from Python dataclasses, ...)
TODO: check
CVE-2026-108384 (dataclasses-avroschema generates Avro schemas from Python dataclasses, ...)
@@ -699,17 +699,17 @@ CVE-2026-108376 (dataclasses-avroschema generates Avro schemas from Python datac
CVE-2026-108375 (dataclasses-avroschema generates Avro schemas from Python dataclasses, ...)
TODO: check
CVE-2026-108185 (Improper certificate validation in the My Notes feature of certain Zoo ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-108184 (Improper certificate validation in certain Zoom Clients for Windows ma ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2026-108179 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108174 (Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107918 (Insufficient input validation vulnerability in the LAN Setup feature o ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-107917 (Insufficient input validation vulnerability in the PPPoE Setup feature ...)
- TODO: check
+ NOT-FOR-US: Netgear
CVE-2026-107832 (fastify is a fast and low overhead web framework for Node.js. In versi ...)
TODO: check
CVE-2026-107607 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Mi ...)
@@ -721,37 +721,37 @@ CVE-2026-107605 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable
CVE-2026-107460 (Server-Side Request Forgery (SSRF) protection in the UrlImageConverter ...)
TODO: check
CVE-2026-106625 (Adobe Framemaker is affected by an out-of-bounds write vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-106598 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106597 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106176 (A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106175 (A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiO ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106173 (A improper limitation of a pathname to a restricted directory ('path t ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106172 (A use of hard-coded cryptographic key vulnerability in Fortinet FortiS ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106171 (A improper neutralization of special elements used in an os command (' ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106170 (An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortine ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-106108 (Quasar Framework is a framework for building high-performance Vue.js u ...)
TODO: check
CVE-2026-106047 (A Path Traversal vulnerability in the template export functionality of ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106043 (A Missing Authentication for Critical Function vulnerability in Ivanti ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106042 (An External Control of File Name or Path vulnerability in Ivanti Xtrac ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106035 (An Information Exposure Through Log Files vulnerability in Ivanti Xtra ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-106034 (A Path Traversal vulnerability in Ivanti Xtraction before version 2026 ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-105881 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105460 (A flaw was found in BlueZ. An out-of-bounds read vulnerability exists ...)
TODO: check
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker Hub's accoun ...)
@@ -759,21 +759,21 @@ CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker Hub's
CVE-2026-104937 (Shopware version 6.7 allows the upload of attacker\u2011controlled HTM ...)
TODO: check
CVE-2026-104935 (Authentication bypass by spoofing in ICS before version 25.1.3.0 allow ...)
- TODO: check
+ NOT-FOR-US: Ivanti
CVE-2026-104817 (Misskey is an open source, federated social media platform. From 12.11 ...)
TODO: check
CVE-2026-104816 (Misskey is an open source, federated social media platform. From 12.0. ...)
TODO: check
CVE-2026-104344 (Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104343 (Adobe Framemaker is affected by a NULL Pointer Dereference vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104342 (Adobe Framemaker is affected by a Use After Free vulnerability that co ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104341 (Adobe Framemaker is affected by an out-of-bounds write vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104340 (Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-104250 (The unstructured library provides open-source components for ingesting ...)
TODO: check
CVE-2026-104192 (Dragonfly is an in-memory data store built for modern application work ...)
@@ -789,9 +789,9 @@ CVE-2026-104005 (A security issue was discovered in MongoDB mongos (the sharded
CVE-2026-104004 (MongoDB Server's collection validation feature may not properly handle ...)
TODO: check
CVE-2026-103967 (Adobe Framemaker is affected by an out-of-bounds write vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103966 (Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103965 (An issue in MongoDB Server's aggregation framework can cause certain c ...)
TODO: check
CVE-2026-103937 (Misskey is an open source, federated social media platform. From 13.0. ...)
@@ -799,21 +799,21 @@ CVE-2026-103937 (Misskey is an open source, federated social media platform. Fro
CVE-2026-103928 (Metabase is an open source business intelligence and analytics platfor ...)
TODO: check
CVE-2026-103857 (Adobe Framemaker is affected by an out-of-bounds read vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103856 (Adobe Framemaker is affected by an out-of-bounds read vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103849 (Adobe Commerce is affected by an Improper Neutralization of Special El ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-103572 (Improper control of generation of code ('code injection') in Visual St ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-103499 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103418 (Firefox for iOS directly interpolated the page\u2019s HTML language at ...)
TODO: check
CVE-2026-103417 (Firefox for iOS could autofill saved credentials into a new page if cr ...)
TODO: check
CVE-2026-103076 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Reg ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103030 (Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2 ...)
TODO: check
CVE-2026-103028 (SFTPGo is an open source, event-driven file transfer solution. From 2. ...)
@@ -827,9 +827,9 @@ CVE-2026-102982 (Plane is an open-source project management tool. Prior to 1.4.0
CVE-2026-102981 (Plane is an open-source project management tool. Prior to 1.4.0, self- ...)
TODO: check
CVE-2026-102850 (Heap-based buffer overflow in Microsoft Office Access allows an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-102849 (Heap-based buffer overflow in Microsoft Office Access allows an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-102832 (JupyterLab is an extensible environment for interactive and reproducib ...)
TODO: check
CVE-2026-102734 (asteval is a Python expression evaluator designed for restricted execu ...)
@@ -839,41 +839,41 @@ CVE-2026-102672 (Electron is a framework for writing cross-platform desktop appl
CVE-2026-102603 (Gotify server is a simple server for sending and receiving messages in ...)
TODO: check
CVE-2026-102562 (The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102342 (ammonia is a Rust library for repairing and securing untrusted HTML. P ...)
TODO: check
CVE-2026-102250 (CWE-345: Insufficient Verification of Data Authenticity vulnerability ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric
CVE-2026-102076 (A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102075 (A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102074 (A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102073 (A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-102007 (The Bit integrations \u2013 Form Integration, Webhook, Spreadsheets, C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101899 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
TODO: check
CVE-2026-101020 (An incorrect permission assignment for critical resource issue exists ...)
TODO: check
CVE-2026-100133 (Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vuln ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-0893 (AMI APTIOV contains a vulnerability in BIOS where an attacker may caus ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58774 (AMI APTIOV contains vulnerabilities in BIOS where users may cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58773 (AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58772 (AMI APTIOV contains vulnerabilities in BIOS where users may cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-58771 (AMI APTIOV contains vulnerabilities in BIOS where users may cause \u20 ...)
- TODO: check
+ NOT-FOR-US: AMI
CVE-2025-57739 (An improper neutralization of special elements used in an SQL Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2025-46773 (An Improper Neutralization of Special Elements used in an SQL Command ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2024-34326 (ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflec ...)
TODO: check
CVE-2024-34324 (An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to ex ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a91a3682107379ba91f0efcd61f1a9aabe42181
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5a91a3682107379ba91f0efcd61f1a9aabe42181
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261013/0d6501ae/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list