[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d132663e by Moritz Muehlenhoff at 2026-10-14T10:34:49+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2749,7 +2749,7 @@ CVE-2026-50216 (An integer underflow exists in the DNS proxy component of the ma
 CVE-2026-50215 (A use-after-free exists in the Windows WFP packet-capture driver shipp ...)
 	NOT-FOR-US: Akamai GPA
 CVE-2026-49950 (Xorbits Xoscar through 0.11.2 contains an unauthenticated deserializat ...)
-	TODO: check
+	NOT-FOR-US: xoscar
 CVE-2026-49785 (Improper resource shutdown or release in Windows UEFI allows an author ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-48398 (Adobe Experience Manager is affected by a DOM-based Cross-Site Scripti ...)
@@ -6515,25 +6515,25 @@ CVE-2026-103903 (An incorrect authorization vulnerability in the WinBox authenti
 CVE-2026-103902 (Improper verification of cryptographic signature vulnerability in Digi ...)
 	TODO: check
 CVE-2026-103537 (Thelia 2.6.1 contains an absolute path traversal vulnerability in its  ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103535 (Thelia v2.6.1 contains path traversal and PHP code injection vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103529 (Thelia v2.6.0 permits authenticated administrators to upload and insta ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103528 (Thelia 2.6.0 uses Smarty for email templates without properly restrict ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103527 (Thelia v2.6.0's Smarty templates (address.html and address-update.html ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103526 (In Thelia v2.6.0, both the administrative login and forgotten password ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103524 (Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities wit ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103523 (Thelia v2.6.0 contains an open redirect vulnerability in its address c ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103522 (In Thelia v2.6.0, the store banner upload feature performs insufficien ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103521 (In Thelia v2.6.0, the document upload endpoint properly blocks the upl ...)
-	TODO: check
+	NOT-FOR-US: Thelia
 CVE-2026-103503 (Improper Certificate Validation vulnerability in hexpm hex allows an a ...)
 	TODO: check
 CVE-2026-103502 (Improper Certificate Validation vulnerability in hexpm hex_core allows ...)
@@ -6543,11 +6543,11 @@ CVE-2026-103356 (Missing Authorization vulnerability in VillaTheme TMDS tmds-dro
 CVE-2026-103080 (External Control of Assumed-Immutable Web Parameter vulnerability in V ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-103061 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
-	TODO: check
+	- gleam <itp> (bug #1103795)
 CVE-2026-103060 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
 	TODO: check
 CVE-2026-102663 (OpenList is a file list program that supports multiple storage backend ...)
-	TODO: check
+	NOT-FOR-US: OpenList
 CVE-2026-XXXX [GHSA-4g67-jhpc-q5xp]
 	- freerdp3 3.32.2+dfsg-1
 	- freerdp2 <removed>



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d132663ec62e33845d827e5a9a4d8b4e53c50304

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d132663ec62e33845d827e5a9a4d8b4e53c50304
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/08220aeb/attachment.htm>