[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 15 08:15:06 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d3aadb17 by security tracker role at 2026-10-15T07:14:59+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,61 +1,61 @@
CVE-2026-96540 (An improper access control vulnerability has been identified in the So ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-96537 (The Tutor LMS WordPress plugin before 4.1.1 does not perform a capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93484 (Znuny through 7.3.6 constructs a ticket-search database query by direc ...)
TODO: check
CVE-2026-93483 (In Znuny through 7.3.6, an attacker can bypass specific standard login ...)
TODO: check
CVE-2026-92429 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92428 (The Rede Ita\xfa for WooCommerce WordPress plugin before 5.5.3 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88043 (The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86803 (The The Ocean Extra plugin for WordPress is vulnerable to arbitrary sh ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81534 (The Email Customizer for WooCommerce (Pro) plugin for WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-79822 (A security vulnerability inHPE NonStop TNS/X Native Inspect may cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79821 (A security vulnerability inHPE NonStop SOAP 4.0 may cause memory corr ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78087 (The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78001 (The Post and Page Builder by BoldGrid \u2013 Visual Drag and Drop Edit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77931 (MoviePilot through 3.1.5 contains a command injection vulnerability th ...)
TODO: check
CVE-2026-77427 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
TODO: check
CVE-2026-76668 (A security vulnerability inHPE NonStop Kernel may allow user space acc ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76667 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76666 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76665 (A security vulnerability inHPE NonStop EXPAND may cause out-of-bounds ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76664 (A security vulnerability inHPE NonStop EXPAND may result in out-of-bou ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76663 (A stack-based buffer overflow vulnerability inHPE NonStop TELSERV can ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76662 (A buffer overflow vulnerability inHPE NonStop TELSERV can cause memory ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76661 (A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write th ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76660 (A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76659 (A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76656 (A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unaut ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76066 (IntentKit through 2.6.3 contains an authorization bypass vulnerability ...)
TODO: check
CVE-2026-74920 (The Document Gallery WordPress plugin through 5.1.1 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-73799 (A security vulnerability inHPE NonStop SNMP Trap Multiplexer may cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-71854 (OpenAEV is an open source platform allowing organizations to plan, sch ...)
TODO: check
CVE-2026-69194 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
@@ -89,17 +89,17 @@ CVE-2026-57490 (FileRise is a self-hosted web-based file manager with multi-file
CVE-2026-57489 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
TODO: check
CVE-2026-55684 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55683 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55682 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55681 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55680 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, un ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55679 (WeGIA is a web manager for charitable institutions. Prior to 3.8.6, th ...)
- TODO: check
+ NOT-FOR-US: WeGIA
CVE-2026-55498 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
TODO: check
CVE-2026-55387 (InvoiceShelf is an open-source web & mobile app that helps track expen ...)
@@ -125,25 +125,25 @@ CVE-2026-54701 (Markdown Preview Enhanced is a Markdown preview extension for Vi
CVE-2026-54566 (Markdown Preview Enhanced is a Markdown preview extension for Visual S ...)
TODO: check
CVE-2026-3712 (The PhastPress plugin for WordPress is vulnerable to Server-Side Reque ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18586 (The Premium Packages \u2013 Sell Digital Products Securely plugin for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18557 (The Photo Gallery by 10Web \u2013 Mobile-Friendly Image Gallery plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18548 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17031 (The Checkout Field Manager (Checkout Manager) for WooCommerce plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-17001 (The Import and export users and customers plugin for WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15180 (The Tracking Code Manager plugin for WordPress is vulnerable to Reflec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-15090 (The Link Library plugin for WordPress is vulnerable to time-based SQL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14572 (The Kirki \u2013 Freeform Page Builder, Website Builder & Customizer p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11905 (The Elementor Website Builder \u2013 more than just a page builder plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110934 (Improper validation of array index vulnerability in Samsung Open Sourc ...)
TODO: check
CVE-2026-110933 (Uncaught exception vulnerability in Samsung Open Source Vyond allows I ...)
@@ -205,35 +205,35 @@ CVE-2026-110856 (GitPython before 3.2.0 contains a regular expression denial of
CVE-2026-110855 (GitPython before 3.2.0 contains an information disclosure vulnerabilit ...)
TODO: check
CVE-2026-110854 (Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not ha ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-110853 (n8n before 1.123.83 contains an authorization bypass vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110852 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110851 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization b ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110850 (n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credentia ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110849 (n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site s ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110848 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110847 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110846 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110845 (n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 conta ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110844 (n8n before 1.123.83 contains an authorization bypass vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110843 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled re ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110842 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollut ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110841 (n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the a ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110840 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection v ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-110839 (FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON ...)
TODO: check
CVE-2026-110838 (FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs d ...)
@@ -273,7 +273,7 @@ CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2
CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0. This vuln ...)
TODO: check
CVE-2026-110689 (A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-110679 (A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impa ...)
TODO: check
CVE-2026-110670 (A vulnerability was found in cemtan sar2html 4.0.0. The affected eleme ...)
@@ -283,33 +283,33 @@ CVE-2026-110669 (A security vulnerability has been detected in cemtan sar2html 4
CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0. Affected by t ...)
TODO: check
CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket can forc ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entit ...)
TODO: check
CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108337 (An administrator could retrieve the password reset code for any user a ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-108336 (When the default self-signed certificate is used, an attacker could ga ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-108335 (When the password reset functionality is enabled, and email is configu ...)
- TODO: check
+ NOT-FOR-US: Hitachi Vantana
CVE-2026-107795 (Omada Controller's MSP and OpenAPI certificate/private-key management ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-106485
REJECTED
CVE-2026-106068
REJECTED
CVE-2026-106031 (The Spin Wheel WordPress plugin before 2.2.1 does not verify that a v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106006
REJECTED
CVE-2026-105627
REJECTED
CVE-2026-104643 (The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104110 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
TODO: check
CVE-2026-104109 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
@@ -327,9 +327,9 @@ CVE-2026-103988 (FileRise is a self-hosted web-based file manager with multi-fil
CVE-2026-103977 (FileRise is a self-hosted web-based file manager with multi-file uploa ...)
TODO: check
CVE-2026-103324 (The Cardinity Payment Gateway for WooCommerce WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103304 (The eaSYNC Booking WordPress plugin before 1.3.31 does not perform au ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102986 (Plane is an open-source project management tool. In 1.3.1 and earlier, ...)
TODO: check
CVE-2026-102985 (Plane is an open-source project management tool. In 1.3.1 and earlier, ...)
@@ -337,7 +337,7 @@ CVE-2026-102985 (Plane is an open-source project management tool. In 1.3.1 and e
CVE-2026-102980 (Plane is an open-source project management tool. Prior to 1.4.0, PageV ...)
TODO: check
CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint fails to ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH ...)
TODO: check
CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory argume ...)
@@ -347,33 +347,33 @@ CVE-2026-101304 (When fdescfs(4) was mounted in a jail with the "nodup" option,
CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero byte of the ...)
TODO: check
CVE-2026-100232 (Post-authentication Improper Neutralization of Special Elements used i ...)
- TODO: check
+ NOT-FOR-US: SonicWall
CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer ove ...)
TODO: check
CVE-2026-0321 (Denial of service vulnerabilities in Palo Alto Networks PAN-OS\xae sof ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0320 (A command injection vulnerability in Palo Alto Networks PAN-OS\xae sof ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0319 (An improper input handling vulnerability in the GlobalProtect\u2122 ga ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0318 (A stack-based buffer overflow vulnerability in the log processing func ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0317 (A denial of service vulnerability in Palo Alto Networks PAN-OS softwar ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0316 (A stored cross-site scripting (XSS) vulnerability in Palo Alto Network ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0315 (A local privilege escalation vulnerability in the Palo Alto Networks G ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0314 (A type confusion vulnerability in Palo Alto Networks GlobalProtect\u21 ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0313 (A command injection vulnerability in Palo Alto Networks Cortex XSOAR a ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0312 (Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2026-0311 (A server-side request forgery vulnerability in Palo Alto Networks Chec ...)
- TODO: check
+ NOT-FOR-US: Palo Alto Networks
CVE-2025-29895 (A NULL pointer dereference vulnerability has been reported to affect Q ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-XXXX [BUG/MAJOR: mux-h2: properly handle short reads on PING frames]
- haproxy 3.2.26-1
NOTE: Fixed by: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=dc338d875ec907f18143ee369552658b750b7297 (v3.2.16)
@@ -6240,7 +6240,7 @@ CVE-2026-107606 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable
CVE-2026-107605 (SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Mi ...)
NOT-FOR-US: SWIFI-SE2KIC
CVE-2026-107460 (Server-Side Request Forgery (SSRF) protection in the UrlImageConverter ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-106625 (Adobe Framemaker is affected by an out-of-bounds write vulnerability t ...)
NOT-FOR-US: Adobe
CVE-2026-106598 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3aadb17cb30cbc1d043a2237db42836c94b425f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d3aadb17cb30cbc1d043a2237db42836c94b425f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/e633f5ba/attachment.htm>
More information about the debian-security-tracker-commits
mailing list