[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Wed Oct 14 13:34:02 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4088a898 by Moritz Muehlenhoff at 2026-10-14T14:33:39+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2801,11 +2801,11 @@ CVE-2026-14532 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0
 CVE-2026-11713 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 i ...)
 	NOT-FOR-US: IBM
 CVE-2026-110467 (Tronclass developed by WisdomGarden has a Insecure Direct Object Refer ...)
-	TODO: check
+	NOT-FOR-US: Tronclass
 CVE-2026-110466 (Tronclass developed by WisdomGarden has a Sensitive Data Exposure vuln ...)
-	TODO: check
+	NOT-FOR-US: Tronclass
 CVE-2026-110465 (Tronclass developed by WisdomGarden has a Insecure Direct Object Refer ...)
-	TODO: check
+	NOT-FOR-US: Tronclass
 CVE-2026-110459 (A malicious actor with access to the network could exploit an Improper ...)
 	NOT-FOR-US: Ubiquity
 CVE-2026-110458 (A malicious actor with access to the network and under certain conditi ...)
@@ -2829,29 +2829,29 @@ CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalat
 CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
 	TODO: check
 CVE-2026-110447 (Collabora Online Built-in CODE Server before 26.4.303 (richdocumentsco ...)
-	TODO: check
+	NOT-FOR-US: Collabora Online Built-in CODE Serve
 CVE-2026-110445 (TeamPlus Messenger developed by Teamplus Technology has a Code Injecti ...)
-	TODO: check
+	NOT-FOR-US: TeamPlus Messenger
 CVE-2026-110444 (TeamPlus Messenger developed by Teamplus Technology has a Code Injecti ...)
-	TODO: check
+	NOT-FOR-US: TeamPlus Messenger
 CVE-2026-110392 (Improper neutralization of special elements used in an OS command ('OS ...)
 	TODO: check
 CVE-2026-110385 (A remote code execution vulnerability in ONLYOFFICE Document Server ve ...)
-	TODO: check
+	NOT-FOR-US: ONLYOFFICEE
 CVE-2026-110359 (Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local p ...)
-	TODO: check
+	NOT-FOR-US: Hyland
 CVE-2026-110256 (Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: Finsys Dockhand
 CVE-2026-110255 (Finsys Dockhand before 1.0.43 contains a response-disclosing server-si ...)
-	TODO: check
+	NOT-FOR-US: Finsys Dockhand
 CVE-2026-110254 (Finsys Dockhand before 1.0.45 contains a server-side request forgery v ...)
-	TODO: check
+	NOT-FOR-US: Finsys Dockhand
 CVE-2026-110130 (Dockhand before 1.0.45 contains an authentication bypass in which the  ...)
-	TODO: check
+	NOT-FOR-US: Finsys Dockhand
 CVE-2026-110112 (Dockhand before 1.0.50 contains a privilege escalation vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: Finsys Dockhand
 CVE-2026-110111 (Xen Orchestra before 6.9.0 contains an improper access control vulnera ...)
-	TODO: check
+	NOT-FOR-US: Xen Orchestra
 CVE-2026-110084 (Adobe Experience Manager is affected by an XML Injection (aka Blind XP ...)
 	NOT-FOR-US: Adobe
 CVE-2026-110083 (Adobe Experience Manager is affected by an Improper Neutralization of  ...)
@@ -2879,7 +2879,7 @@ CVE-2026-110073 (Adobe Experience Manager is affected by a stored Cross-Site Scr
 CVE-2026-110037 (Adobe Experience Manager is affected by a stored Cross-Site Scripting  ...)
 	NOT-FOR-US: Adobe
 CVE-2026-110005 (The `periphery` agent's container-management functionality of Komodo v ...)
-	TODO: check
+	NOT-FOR-US: Komodo
 CVE-2026-110002 (The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arb ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-109453 (Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver  ...)
@@ -2921,7 +2921,7 @@ CVE-2026-108398 (Untrusted search path in .NET Framework allows an authorized at
 CVE-2026-108396 (Time-of-check time-of-use (toctou) race condition in Windows Modern De ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-108388 (Indico is a feature-rich event management system. Indico 3.3.3 through ...)
-	TODO: check
+	NOT-FOR-US: Indico
 CVE-2026-108136 (Use after free in Microsoft Windows Search Component allows an authori ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-108135 (Improper link resolution before file access ('link following') in Wind ...)
@@ -2975,11 +2975,11 @@ CVE-2026-107160 (The LTL Freight Quotes  WordPress plugin before 4.2.19 does not
 CVE-2026-107158 (The LTL Freight Quotes  WordPress plugin before 4.2.19 does not perfor ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-107153 (Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP tes ...)
-	TODO: check
+	NOT-FOR-US: Rakuten
 CVE-2026-107126 (The WP Booking System  WordPress plugin before 2.1.0.1 does not saniti ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-106931 (SiteGuard Server Edition contains an OS command injection vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: SiteGuard Server Edition
 CVE-2026-106646 (The Classified Listing  WordPress plugin before 6.1.1 does not verify  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-106634 (Adobe Experience Manager is affected by an Improper Limitation of a Pa ...)
@@ -3119,9 +3119,9 @@ CVE-2026-105443 (IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.
 CVE-2026-105442 (IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Applic ...)
 	NOT-FOR-US: IBM
 CVE-2026-105429 (Improper neutralization of special elements in the NetBird client SSH  ...)
-	TODO: check
+	NOT-FOR-US: NetBird
 CVE-2026-105390 (Improper synchronization in the OpenVPN ovpn-dco-win for Windows versi ...)
-	TODO: check
+	NOT-FOR-US: OpenVPN ovpn-dco-win driver
 CVE-2026-105261 (The Schedule Post Changes With PublishPress Future: Unpublish, Delete, ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105151
@@ -3323,7 +3323,7 @@ CVE-2026-102855 (Heap-based buffer overflow in Microsoft Office Visio allows an
 CVE-2026-102851 (Incorrect privilege assignment in Visual Studio Code allows an authori ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-102599 (Socket.IO enables bidirectional and low-latency communication for ever ...)
-	TODO: check
+	NOT-FOR-US: Node socket.io
 CVE-2026-102502 (CAI Content Credentials is affected by an Improper Verification of Cry ...)
 	NOT-FOR-US: Adobe
 CVE-2026-102501 (CAI Content Credentials is affected by an Improper Input Validation vu ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4088a8982c281ab891f4c4224beccfe547c25979

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4088a8982c281ab891f4c4224beccfe547c25979
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/2b43d271/attachment.htm>

More information about the debian-security-tracker-commits mailing list