[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 15 20:16:02 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4a1376f5 by security tracker role at 2026-10-15T19:15:55+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,13 +1,13 @@
CVE-2026-9703 (Grafana's data source proxy did not apply role-based access control to ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-97712 (Sonatype Nexus Repository 3 allows a user that holds the role create o ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-97667 (Sonatype Nexus Repository 3 allows a user account that holds the edit ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-97666 (Sonatype Nexus Repository 3 allows an unauthenticated remote attacker ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-97665 (A missing authorization check in Nexus Repository 3's NuGet Components ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-97394 (kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 u ...)
TODO: check
CVE-2026-97370 (Junrar is an open source Java RAR archive library. Prior to 7.6.1, Rar ...)
@@ -15,7 +15,7 @@ CVE-2026-97370 (Junrar is an open source Java RAR archive library. Prior to 7.6.
CVE-2026-96614 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION is vulner ...)
TODO: check
CVE-2026-96449 (Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95180 (An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a ...)
TODO: check
CVE-2026-95179 (An issue in lottie-android 6.7.1 and earlier (and master) allows a rem ...)
@@ -31,7 +31,7 @@ CVE-2026-92982 (A flaw was found in Ansible Operator Plugins. A low-privileged K
CVE-2026-92707 (MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.30 ...)
TODO: check
CVE-2026-8145 (The WholesaleX \u2013 B2B & Wholesale Plugin for WooCommerce with Whol ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity (XXE) inject ...)
TODO: check
CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extra ...)
@@ -43,47 +43,47 @@ CVE-2026-87018 (undici is an HTTP client library for Node.js. In versions 4.2.1
CVE-2026-85634 (A flaw was found in the ContentRepositoryImpl.copyExplodedContent func ...)
TODO: check
CVE-2026-84731 (An unauthenticated remote attacker can bypass authentication and gain ...)
- TODO: check
+ NOT-FOR-US: Nutanix
CVE-2026-79843 (A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EX ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79841 (A buffer overflow vulnerability inHPE NonStop RDMA SERVICES NSK may ca ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79840 (A buffer overflow vulnerability inHPE NonStop XABroker may cause memor ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79839 (A buffer overflow vulnerability inHPE NonStop ODBC/MX Server may cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79838 (A buffer overflow vulnerability inHPE NonStop ODBC/MX Services may cau ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79837 (A vulnerability inHPE NonStop SQL/MX UDR SERVER may allow a crafted me ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79836 (A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an at ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79835 (A crafted input message can cause a buffer overflow in HPE Nonstop KMS ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79834 (A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an una ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79833 (A vulnerability inHPE NonStop ANSI SQLUTIL may allow a remote unauthen ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79832 (A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor m ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79831 (A heap buffer overflow in HPE NonStop Posix User Threads may allow arb ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79830 (A vulnerability inHPE NonStop Kernel Level Thread Model Lib can cause ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79829 (A security vulnerability inHPE NonStop HTTP WEBSERVER can cause memory ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79828 (A heap buffer overflow in HPE NonStop Debug Utilities could corrupt r ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79827 (A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79826 (A heap buffer overflow in HPE NonStop OCAX could corrupt address space ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79825 (A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-exe ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79824 (A directory traversal vulnerability inHPE NonStop Python 3.x could all ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79823 (HPE NonStop EMS Distributor is vulnerable to buffer overflow condition ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78851 (Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allo ...)
TODO: check
CVE-2026-78850 (An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensiti ...)
@@ -185,11 +185,11 @@ CVE-2026-55184 (EspoCRM is an open source customer relationship management appli
CVE-2026-55154 (EspoCRM is an open source customer relationship management application ...)
TODO: check
CVE-2026-55103 (Discourse ActivityPub adds ActivityPub support to Discourse. Prior to ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2026-54683 (NL Portal Backend Libraries provide backend components for Dutch gover ...)
TODO: check
CVE-2026-53882 (An improper link resolution before file access ('link following') vuln ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-53582 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
TODO: check
CVE-2026-53575 (EspoCRM is an open source customer relationship management application ...)
@@ -199,13 +199,13 @@ CVE-2026-53574 (EspoCRM is an open source customer relationship management appli
CVE-2026-52167 (A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2 ...)
TODO: check
CVE-2026-50619 (A path traversal vulnerability has been reported to affect Qsirch. If ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-50612 (An unix symbolic link (symlink) following vulnerability has been repor ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-47790 (A cross-site scripting (XSS) vulnerability has been reported to affect ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-47786 (An OS command injection vulnerability has been reported to affect Hybr ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-47218 (runwasi facilitates running Wasm and WASI workloads managed by contain ...)
TODO: check
CVE-2026-47168 (EspoCRM is an open source customer relationship management application ...)
@@ -225,59 +225,59 @@ CVE-2026-45450 (: Improper Restriction of Operations within the Bounds of a Memo
CVE-2026-45449 (: Improper Neutralization of Special Elements used in an OS Command (' ...)
TODO: check
CVE-2026-44084 (An authorization bypass through user-controlled key vulnerability has ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-41545 (A relative path traversal vulnerability has been reported to affect Qu ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-41544 (A path traversal vulnerability has been reported to affect QcalAgent. ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-41541 (An unix symbolic link (symlink) following vulnerability has been repor ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-39997 (A missing authentication for critical function vulnerability has been ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-39993 (A relative path traversal vulnerability has been reported to affect Do ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-39991 (A cross-site scripting (XSS) vulnerability has been reported to affect ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-39989 (A server-side request forgery (SSRF) vulnerability has been reported t ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-35088 (Slican telephone exchangesuse symmetric encryption for TCP/IP communic ...)
TODO: check
CVE-2026-34015 (A path traversal vulnerability has been reported to affect Video Stati ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-34014 (An incorrect permission assignment for critical resource vulnerability ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-34009 (An improper isolation or compartmentalization vulnerability has been r ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-34008 (An incorrect permission assignment for critical resource vulnerability ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-34007 (An OS command injection vulnerability has been reported to affect Note ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-34006 (A missing authentication for critical function vulnerability has been ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-26245 (A SQL injection vulnerability has been reported to affect Video Statio ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-26244 (A SQL injection vulnerability has been reported to affect Video Statio ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-26243 (A path traversal vulnerability has been reported to affect Qsync Centr ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-24723 (A NULL pointer dereference vulnerability has been reported to affect F ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-24722 (A NULL pointer dereference vulnerability has been reported to affect F ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-24721 (A NULL pointer dereference vulnerability has been reported to affect F ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-24718 (A path traversal vulnerability has been reported to affect Qsync Centr ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-24715 (An observable timing discrepancy vulnerability has been reported to af ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-22896 (A cross-site scripting (XSS) vulnerability has been reported to affect ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2026-19864 (Eclipse Jetty's `SessionAuthentication` retains authentication credent ...)
TODO: check
CVE-2026-19863 (An unauthenticated client may access certain protected resources when ...)
TODO: check
CVE-2026-19377 (Improper certificate validation in the tunnel handshake in Cato Client ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-18662 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
TODO: check
CVE-2026-18661 (In Eclipse Jetty, across various versions of `jetty-annotations`, and ...)
@@ -287,13 +287,13 @@ CVE-2026-18660 (In Eclipse Jetty, across various versions of `jetty-server`, and
CVE-2026-18659 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
TODO: check
CVE-2026-17525 (Incomplete cleanup vulnerability in ABB My Control System. This issue ...)
- TODO: check
+ NOT-FOR-US: ABB group
CVE-2026-16438 (Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GE ...)
- TODO: check
+ NOT-FOR-US: Mitsubishi
CVE-2026-16437 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
- TODO: check
+ NOT-FOR-US: Mitsubishi
CVE-2026-16436 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
- TODO: check
+ NOT-FOR-US: Mitsubishi
CVE-2026-111252 (A denial of service vulnerability exists in the XML parsing of multipl ...)
TODO: check
CVE-2026-111235 (An authorization bypass vulnerability exists in the REST API of multip ...)
@@ -443,33 +443,33 @@ CVE-2026-111123 (FluidSynth through 2.6.1 contains an out-of-bounds write vulner
CVE-2026-111105 (Telegram rlottie Numeric Truncation Remote Code Execution Vulnerabilit ...)
TODO: check
CVE-2026-111096 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-111095 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-111094 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-111093 (In JetBrains Datalore before 2026.2.1 unauthenticated path traversal v ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-111092 (In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 20 ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-111091 (In JetBrains Junie CLI before 26.8.3 code execution was possible via a ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-110958 (A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The im ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-110957 (A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V ...)
- TODO: check
+ NOT-FOR-US: Wavlink
CVE-2026-110936 (A vulnerability has been identified in Siemens Software Center (All ve ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-110927 (A flaw was found in OpenSSH. After compression is negotiated, a compre ...)
TODO: check
CVE-2026-110924 (A flaw was found in OpenSSH. With GSSAPI authentication enabled, a fai ...)
TODO: check
CVE-2026-110891 (Missing Authorization vulnerability in WordLift Srl WordLift wordlift ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110890 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110888 (Missing Authorization vulnerability in Meow Apps AI Engine ai-engine a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110878 (Aureus ERP through 1.6.0 contains a stored cross-site scripting vulner ...)
TODO: check
CVE-2026-110877 (AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in ...)
@@ -479,9 +479,9 @@ CVE-2026-110876 (AdPlug through 2.4 contains an out-of-bounds read vulnerability
CVE-2026-110875 (AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer ...)
TODO: check
CVE-2026-110874 (Dolibarr before 23.0.4 contains a PHP object injection vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-110812 (Deserialization of untrusted data in the Gremlin graph data import com ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-110746 (A local privilege escalation vulnerability in TotalAV allows an unpriv ...)
TODO: check
CVE-2026-110726 (In `api-gateway` versions till `1.7.3`, The default rate-limit key res ...)
@@ -491,35 +491,35 @@ CVE-2026-110724 (In `api-gateway` versions till `1.7.3`, The default rate-limit
CVE-2026-110723 (In `api-gateway` versions till `1.7.3`, The default rate-limit key res ...)
TODO: check
CVE-2026-110381 (Authorization Bypass Through User-Controlled Key vulnerability in NSqu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110378 (Missing Authorization vulnerability in WP E-Signature Ninja Forms Sign ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110375 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110374 (Missing Authorization vulnerability in Hamid Alinia Login with phone n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110371 (Missing Authorization vulnerability in WP Chill Strong Testimonials st ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110367 (Missing Authorization vulnerability in WPExperts APIExperts Square for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110364 (Missing Authorization vulnerability in WP Desk Flexible Quantity \u201 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110362 (Missing Authorization vulnerability in Planet studio PlanetStudio Paym ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110361 (Insertion of Sensitive Information Into Sent Data vulnerability in Cli ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110360 (Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109932 (undici is an HTTP client library for Node.js. In versions 5.15.0 throu ...)
TODO: check
CVE-2026-109924 (undici is an HTTP client library for Node.js. In versions 6.5.0 throug ...)
TODO: check
CVE-2026-109897 (Missing Authorization vulnerability in WP Chill Strong Testimonials st ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109893 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109892 (Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109869 (undici is an HTTP client library for Node.js. In versions 6.23.0 throu ...)
TODO: check
CVE-2026-109855 (undici is an HTTP client library for Node.js. In versions 8.11.0 and 8 ...)
@@ -529,25 +529,25 @@ CVE-2026-109841 (undici is an HTTP client library for Node.js. In versions 7.15.
CVE-2026-109829 (undici is an HTTP client library for Node.js. In versions 7.0.0 throug ...)
TODO: check
CVE-2026-109702 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109698 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109695 (Insertion of Sensitive Information Into Sent Data vulnerability in WPM ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109694 (Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Flu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109693 (Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Flu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109692 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109689 (Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109688 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109686 (Deserialization of Untrusted Data vulnerability in Link Whisper INC Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109685 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109449 (InSymfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21 ...)
TODO: check
CVE-2026-109413 (In Symfony YAML prior to versions5.4.54,6.4.45,7.4.18, and8.1.6,Yaml\P ...)
@@ -557,25 +557,25 @@ CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions 4.0.0
CVE-2026-109131 (The Hub collection module documentation renderer in the unified Ansibl ...)
TODO: check
CVE-2026-108499 (Missing Authorization vulnerability in WebberZone Knowledge Base knowl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108498 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108497 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108491 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108334 (A flaw was found in the internal WebAssembly (WASM) shim used by the K ...)
TODO: check
CVE-2026-108175 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108116 (In Progress Kendo UI for jQuery prior to v2026.3.1015, specially craft ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-108092 (The Blog2Social \u2013 Social Media Auto Post & Scheduler plugin for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108082 (Symfony is a PHP framework for web and console applications and a set ...)
TODO: check
CVE-2026-107416 (Authorization Bypass Through User-Controlled Key vulnerability in Webb ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106707 (XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) ...)
TODO: check
CVE-2026-106706 (XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scri ...)
@@ -583,35 +583,35 @@ CVE-2026-106706 (XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-si
CVE-2026-106701 (ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) vi ...)
TODO: check
CVE-2026-106604 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106163 (In Progress\xae Kendo\xae UI for jQuery versions starting with v2023.1 ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106162 (In Progress\xae Kendo\xae UI for jQuery versions starting with 2023.3. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106161 (In Progress\xae Kendo\xae UI for jQuery releases starting with v2020.1 ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106160 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015, Model.ac ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106159 (In Progress\xae Kendo\xae UI for jQuery versions starting with 2022.3. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106158 (In Progress\xae Kendo\xae UI for jQuery, in v2026.3.811 and earlier, t ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106157 (In Progress\xae Kendo\xae UI for jQuery versions starting with 2019.2. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106153 (In Progress\xae Kendo\xae UI for jQuery prior to version 2026.3.1015, ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106151 (In Progress\xae Kendo\xae UI for jQuery versions starting with 2012.2. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106150 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015, the Spli ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106149 (In Progress\xae Kendo\xae UI for jQuery prior to v2026.3.1015, the Men ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106148 (In Progress\xae Kendo\xae UI for jQuery prior to 2026.3.1015, the TabS ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-106147 (In Progress\xae Kendo\xae UI for jQuery releases starting with R1 2020 ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-105882 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105660 (Improper Validation of Syntactic Correctness of Input vulnerability in ...)
TODO: check
CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to version 2.0 ...)
@@ -619,7 +619,7 @@ CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to vers
CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION contains ...)
TODO: check
CVE-2026-105065 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104828 (HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, H ...)
TODO: check
CVE-2026-104827 (react/http is an event-driven, streaming HTTP client and server implem ...)
@@ -641,17 +641,17 @@ CVE-2026-104024 (Incomplete List of Disallowed Inputs (CWE-184) in the dangerous
CVE-2026-103936 (libp2p is a JavaScript implementation of the libp2p networking stack. ...)
TODO: check
CVE-2026-103509 (P4 Search (formerly Helix Search) returns stored credentials in cleart ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103508 (P4 Search (formerly Helix Search) allows an authenticated user holding ...)
- TODO: check
+ NOT-FOR-US: Perforce
CVE-2026-103350 (Improper Validation of Specified Quantity in Input vulnerability in Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103224 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-103223 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-103083 (Authorization Bypass Through User-Controlled Key vulnerability in ELEX ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102946 (joserfc is a Python library that provides an implementation of several ...)
TODO: check
CVE-2026-102740 (The AsyncHttpClient library allows Java applications to execute HTTP r ...)
@@ -661,27 +661,27 @@ CVE-2026-102631 (In authd before 0.7.1, the user identity matching in UpdateUser
CVE-2026-102527 (Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2 ...)
TODO: check
CVE-2026-102477 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102475 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102469 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102467 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102466 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102465 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102464 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102463 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102462 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102461 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102389 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-101311 (The framebuffer device model's maximum resolution constants were dupli ...)
TODO: check
CVE-2026-101310 (The HDA audio device model did not check for zero-length Buffer Descri ...)
@@ -695,11 +695,11 @@ CVE-2026-101307 (When the PCM sample array needs to grow, the RACK stack doubles
CVE-2026-101303 (The IPv6 UDP send path for unconnected sockets did not apply the jail ...)
TODO: check
CVE-2026-101290 (A remote attacker may send a specially crafted network packet that cau ...)
- TODO: check
+ NOT-FOR-US: SICK AG
CVE-2026-101287 (Authentication bypass vulnerability in Stela, versions prior to 1.60.1 ...)
TODO: check
CVE-2026-100409 (OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-100354 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149 ...)
TODO: check
CVE-2026-100353 (kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 u ...)
@@ -717,21 +717,21 @@ CVE-2026-100348 (kin-openapi is a Go project for handling OpenAPI files. Prior t
CVE-2026-100347 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
TODO: check
CVE-2025-68404 (A time-of-check time-of-use (toctou) race condition vulnerability has ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-68403 (An external control of system or configuration setting vulnerability h ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-66275 (A path traversal vulnerability has been reported to affect Video Stati ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-66272 (A path traversal vulnerability has been reported to affect Video Stati ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-29897 (A buffer copy without checking size of input vulnerability has been re ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-29896 (A NULL pointer dereference vulnerability has been reported to affect Q ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-23390 (A vulnerability has been identified within Fleet where, by default, Fl ...)
TODO: check
CVE-2024-22031 (A vulnerability has been identified within Rancher where a user with t ...)
- TODO: check
+ NOT-FOR-US: SUSE
CVE-2023-32198 (A vulnerability has been identified in Steve where by default it was u ...)
TODO: check
CVE-2026-99999 (In the Linux kernel, the following vulnerability has been resolved: i ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a1376f50d88d37db7188e7fb2ef9dd12864e6f7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4a1376f50d88d37db7188e7fb2ef9dd12864e6f7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/1c496bb5/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list