[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Oct 14 09:19:40 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
163c7c55 by Moritz Muehlenhoff at 2026-10-14T10:19:04+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -201,7 +201,7 @@ CVE-2026-97471 (The Avada (Fusion) Builder plugin for WordPress is vulnerable to
CVE-2026-97398 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-97381 (Legacy Update is a tool for activating and installing updates on legac ...)
- TODO: check
+ NOT-FOR-US: LegacyUpdate
CVE-2026-97312 (Photoshop Desktop is affected by an out-of-bounds write vulnerability ...)
NOT-FOR-US: Adobe
CVE-2026-97020 (The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Si ...)
@@ -577,7 +577,7 @@ CVE-2026-94453 (Libreswan's pluto daemon has a use-after-free vulnerability when
CVE-2026-94377 (The Verified Reviews (Avis V\xe9rifi\xe9s) plugin for WordPress is vul ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94370 (A defect in the Qt for MCUs core string handling causes heap memory co ...)
- TODO: check
+ NOT-FOR-US: Qt for MCUs
CVE-2026-94360 (The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 d ...)
NOT-FOR-US: WordPress plugin
CVE-2026-94261 (The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a p ...)
@@ -597,7 +597,7 @@ CVE-2026-93885 (The Cryptocurrency Donation Box \u2013 Bitcoin & Crypto Donation
CVE-2026-93388 (The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92817 (The Ignition Perspective module does not properly validate session pri ...)
- TODO: check
+ NOT-FOR-US: Ignition
CVE-2026-92426 (The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not che ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92409 (The Donation Thermometer WordPress plugin before 2.3.0 does not escape ...)
@@ -615,7 +615,7 @@ CVE-2026-90531 (Adobe Experience Manager is affected by an Improper Restriction
CVE-2026-90530 (ColdFusion RDS is affected by an Improper Limitation of a Pathname to ...)
NOT-FOR-US: Adobe
CVE-2026-89310 (A parameter taken from the request body is inserted into a T-SQL state ...)
- TODO: check
+ NOT-FOR-US: JTL-WMS
CVE-2026-89288 (The Fast Courier WordPress plugin before 5.2.4 does not sanitize and ...)
NOT-FOR-US: WordPress plugin
CVE-2026-88927 (The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin bef ...)
@@ -937,11 +937,11 @@ CVE-2026-86607 (Internal Application Information Exposure Vulnerability in Hitac
CVE-2026-86573 (Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX ...)
NOT-FOR-US: Hitachi
CVE-2026-86063 (Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Co ...)
- TODO: check
+ NOT-FOR-US: Claude Code
CVE-2026-86022 (VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::Extern ...)
- TODO: check
+ NOT-FOR-US: VNote
CVE-2026-86016 (VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assign ...)
- TODO: check
+ NOT-FOR-US: VNote
CVE-2026-85945 (Use after free in Windows Kernel allows an authorized attacker to elev ...)
NOT-FOR-US: Microsoft
CVE-2026-85943 (Time-of-check time-of-use (toctou) race condition in Reliable Multicas ...)
@@ -1281,7 +1281,7 @@ CVE-2026-85318 (Heap-based buffer overflow in Servicing Stack Updates allows an
CVE-2026-85000 (The EmbedPress WordPress plugin before 4.6.8 does not perform any cap ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84994 (Qwik is a performance-focused JavaScript framework. Prior to @builder. ...)
- TODO: check
+ - qwik <removed>
CVE-2026-84420 (Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Wi ...)
NOT-FOR-US: Citrix
CVE-2026-84419 (Out-of-bounds write vulnerability in Citrix Workspace app for Windows. ...)
@@ -2679,47 +2679,47 @@ CVE-2026-66822 (Insertion of sensitive information into sent data in .NET allows
CVE-2026-65674 (Deserialization of untrusted data in SQL Server allows an authorized a ...)
NOT-FOR-US: Microsoft
CVE-2026-63174 (Omnispace Agora Project before 26.10.0 contains a broken access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63172 (Omnispace Agora Project before 26.10.0 contains a broken access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63171 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63169 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63168 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63165 (Omnispace Agora Project before 26.10.0 contains a SQL injection vulner ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63163 (Omnispace Agora Project before 26.10.0 contains a broken access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63162 (Omnispace Agora Project before 26.10.0 contains a path traversal vulne ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63161 (Omnispace Agora Project before 26.10.0 contains a session fixation vul ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63160 (Omnispace Agora Project before 26.10.0 contains a vulnerability where ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63159 (Omnispace Agora Project before 26.10.0 contains a predictable password ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63158 (Omnispace Agora Project before 26.10.0 contains an authentication bypa ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63157 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63156 (Omnispace Agora Project before 26.10.0 contains a reflected cross-site ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63154 (Omnispace Agora Project before 26.10.0 contains a SQL identifier injec ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63153 (Omnispace Agora Project before 26.10.0 contains a broken access contro ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63152 (Omnispace Agora Project before 26.10.0 contains a second-order SQL inj ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63149 (Omnispace Agora Project before 26.10.0 contains an insecure randomness ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63148 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63147 (Omnispace Agora Project before 26.10.0 contains a stored cross-site sc ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-63146 (Omnispace Agora Project before 26.10.0 contains a code injection vulne ...)
- TODO: check
+ NOT-FOR-US: Omnispace Agora Project
CVE-2026-62879 (Missing authentication for critical function in Windows SmartScreen al ...)
NOT-FOR-US: Microsoft
CVE-2026-62840 (Time-of-check time-of-use (toctou) race condition in Linux Kernel allo ...)
@@ -2733,21 +2733,21 @@ CVE-2026-59116 (Use of a broken or risky cryptographic algorithm in Windows Remo
CVE-2026-58280 (Uncontrolled recursion in .NET allows an unauthorized attacker to deny ...)
NOT-FOR-US: Microsoft
CVE-2026-56826 (Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-55601 (MultiTail is a utility for monitoring multiple log files in one termin ...)
- TODO: check
+ NOT-FOR-US: MultiTail
CVE-2026-53564 (Vulnerability in Citrix UniconOS leading toArbitrary file read and wri ...)
NOT-FOR-US: Citrix
CVE-2026-53563 (Vulnerability in Citrix UniconOS leading to Persistent Command Executi ...)
NOT-FOR-US: Citrix
CVE-2026-50218 (Akamai GPA (Guardicore Platform Agent) client on all platforms before ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50217 (A use-after-free vulnerability in the Windows WFP callout driver of Ak ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50216 (An integer underflow exists in the DNS proxy component of the macOS Ne ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-50215 (A use-after-free exists in the Windows WFP packet-capture driver shipp ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-49950 (Xorbits Xoscar through 0.11.2 contains an unauthenticated deserializat ...)
TODO: check
CVE-2026-49785 (Improper resource shutdown or release in Windows UEFI allows an author ...)
@@ -2763,7 +2763,7 @@ CVE-2026-48378 (CAI Content Credentials is affected by an Improper Input Validat
CVE-2026-48377 (CAI Content Credentials is affected by an Improper Input Validation vu ...)
NOT-FOR-US: Adobe
CVE-2026-46449 (The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is aff ...)
- TODO: check
+ NOT-FOR-US: Akamai GPA
CVE-2026-34634 (ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnera ...)
NOT-FOR-US: Adobe
CVE-2026-34633 (ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnera ...)
@@ -2773,7 +2773,7 @@ CVE-2026-19810 (Symantec Endpoint Detection and Response (SEDR) Console, prior t
CVE-2026-17092 (The Directorist: AI-Powered Business Directory, Listings & Classified ...)
NOT-FOR-US: WordPress plugin
CVE-2026-16753 (Incorrect authorization in the library-query execution endpoint in Low ...)
- TODO: check
+ NOT-FOR-US: lowcoder
CVE-2026-16495 (The Countdown Timer \u2013 Widget Countdown plugin for WordPress is vu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-15468 (Authorization bypass through User-Controlled key vulnerability in HYPR ...)
@@ -2781,7 +2781,7 @@ CVE-2026-15468 (Authorization bypass through User-Controlled key vulnerability i
CVE-2026-14909 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 i ...)
NOT-FOR-US: IBM
CVE-2026-14765 (Epic Games Unreal Engine versions up to and including 5.8.0 ship with ...)
- TODO: check
+ NOT-FOR-US: Epic Games Unreal Engine
CVE-2026-14532 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 c ...)
NOT-FOR-US: IBM
CVE-2026-11713 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 i ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163c7c555d21947e7c55f06906ef0c7dd6b51928
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/163c7c555d21947e7c55f06906ef0c7dd6b51928
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/30c657e3/attachment.htm>
More information about the debian-security-tracker-commits
mailing list