[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Oct 15 20:46:48 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
300dd08a by Moritz Muehlenhoff at 2026-10-15T21:46:28+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -91,83 +91,83 @@ CVE-2026-78850 (An issue in Matomo v.5.11.2 allows a remote attacker to obtain s
CVE-2026-77711 (When Jetty's `HttpClient` make a request to a server through a forward ...)
TODO: check
CVE-2026-77470 (Lychee is a free, open-source photo-management tool. Prior to 7.7.1, t ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-77468 (Lychee is a free, open-source photo-management tool. Prior to 7.7.0, G ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-77467 (Lychee is a free, open-source photo-management tool. Prior to 7.7.0, L ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-77466 (Lychee is a free, open-source photo-management tool. Prior to 7.7.0, L ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-77460 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-76184 (In Eclipse Jetty, HttpClient may receive a redirect of the form: `` ...)
TODO: check
CVE-2026-76182 (In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be config ...)
TODO: check
CVE-2026-75559 (The smartphone application "Vehicle Inspection Certificate Viewer" con ...)
- TODO: check
+ NOT-FOR-US: Vehicle Inspection Certificate Viewer
CVE-2026-75505 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-72528 ("Handmade Marketplace App - Creema" provided by CREEMA LTD. contains a ...)
- TODO: check
+ NOT-FOR-US: Handmade Marketplace App - Creema
CVE-2026-71490 (OPNsense is a FreeBSD based firewall and routing platform. Prior to 26 ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-63442 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-63430 (ammonia is a Rust library for repairing and securing untrusted HTML. P ...)
TODO: check
CVE-2026-63315 (WebCTI service for Slican IPx telephone exchangesstorestemporary subsc ...)
- TODO: check
+ NOT-FOR-US: WebCTI
CVE-2026-63314 (WebCTI service for Slican IPx telephone exchangesis vulnerable to SQL ...)
- TODO: check
+ NOT-FOR-US: WebCTI
CVE-2026-63130 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-62679 (Lychee is a free, open-source photo-management tool. Prior to 7.6.4, S ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-62322 (Python Social Auth is a social authentication/registration mechanism. ...)
TODO: check
CVE-2026-61838 (Lychee is a free, open-source photo-management tool. Prior to 7.6.3, G ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-61611 (Lychee is a free, open-source photo-management tool. Prior to 7.6.1, P ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-61610 (Lychee is a free, open-source photo-management tool. Prior to 7.6.1, w ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-59994 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-58395 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-58394 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-58393 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-58392 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-58391 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-58390 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-57569 (Lychee is a free, open-source photo-management tool. Prior to 7.6.0, t ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-57568 (Lychee is a free, open-source photo-management tool. Prior to 7.6.0, L ...)
- TODO: check
+ NOT-FOR-US: Lychee
CVE-2026-57496 (NetLicensing MCP Server is a natural-language interface that enables a ...)
- TODO: check
+ NOT-FOR-US: NetLicensing MCP Server
CVE-2026-57183 (Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1 ...)
- TODO: check
+ NOT-FOR-US: Schoold
CVE-2026-57155 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-55876 (Helium is a free online student planner for classes, homework, grades, ...)
- TODO: check
+ NOT-FOR-US: Helium
CVE-2026-55875 (Helium is a free online student planner for classes, homework, grades, ...)
- TODO: check
+ NOT-FOR-US: Helium
CVE-2026-55872 (GYM One is open-source gym management software for fitness centers, pe ...)
- TODO: check
+ NOT-FOR-US: GYM One
CVE-2026-55871 (GYM One is open-source gym management software for fitness centers, pe ...)
- TODO: check
+ NOT-FOR-US: GYM One
CVE-2026-55842 (Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1 ...)
- TODO: check
+ NOT-FOR-US: Schoold
CVE-2026-55840 (Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1 ...)
- TODO: check
+ NOT-FOR-US: Schoold
CVE-2026-55587 (AliasVault is a privacy-first password manager with built-in email ali ...)
TODO: check
CVE-2026-55467 (OpenPrinting CUPS is an open source printing system for Linux and othe ...)
@@ -181,9 +181,9 @@ CVE-2026-55240 (Tianji is an open source analytics, uptime monitoring, and serve
CVE-2026-55239 (Tianji is an open source analytics, uptime monitoring, and server stat ...)
TODO: check
CVE-2026-55184 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-55154 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-55103 (Discourse ActivityPub adds ActivityPub support to Discourse. Prior to ...)
NOT-FOR-US: Discourse
CVE-2026-54683 (NL Portal Backend Libraries provide backend components for Dutch gover ...)
@@ -191,13 +191,13 @@ CVE-2026-54683 (NL Portal Backend Libraries provide backend components for Dutch
CVE-2026-53882 (An improper link resolution before file access ('link following') vuln ...)
NOT-FOR-US: QNAP
CVE-2026-53582 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-53575 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-53574 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-52167 (A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2 ...)
- TODO: check
+ NOT-FOR-US: AOC LC32D1320
CVE-2026-50619 (A path traversal vulnerability has been reported to affect Qsirch. If ...)
NOT-FOR-US: QNAP
CVE-2026-50612 (An unix symbolic link (symlink) following vulnerability has been repor ...)
@@ -209,21 +209,21 @@ CVE-2026-47786 (An OS command injection vulnerability has been reported to affec
CVE-2026-47218 (runwasi facilitates running Wasm and WASI workloads managed by contain ...)
TODO: check
CVE-2026-47168 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-46708 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-46694 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-46691 (EspoCRM is an open source customer relationship management application ...)
- TODO: check
+ NOT-FOR-US: EspoCRM
CVE-2026-45452 (Use of Externally-Controlled format string vulnerability in Unitronics ...)
- TODO: check
+ NOT-FOR-US: Unitronics
CVE-2026-45451 (: Improper Authentication vulnerability in Unitronics Unitronics UniSt ...)
- TODO: check
+ NOT-FOR-US: Unitronics
CVE-2026-45450 (: Improper Restriction of Operations within the Bounds of a Memory Buf ...)
- TODO: check
+ NOT-FOR-US: Unitronics
CVE-2026-45449 (: Improper Neutralization of Special Elements used in an OS Command (' ...)
- TODO: check
+ NOT-FOR-US: Unitronics
CVE-2026-44084 (An authorization bypass through user-controlled key vulnerability has ...)
NOT-FOR-US: QNAP
CVE-2026-41545 (A relative path traversal vulnerability has been reported to affect Qu ...)
@@ -275,7 +275,7 @@ CVE-2026-22896 (A cross-site scripting (XSS) vulnerability has been reported to
CVE-2026-19864 (Eclipse Jetty's `SessionAuthentication` retains authentication credent ...)
TODO: check
CVE-2026-19863 (An unauthenticated client may access certain protected resources when ...)
- TODO: check
+ NOT-FOR-US: EtheriumAuthenticator
CVE-2026-19377 (Improper certificate validation in the tunnel handshake in Cato Client ...)
NOT-FOR-US: Cato
CVE-2026-18662 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
@@ -299,7 +299,7 @@ CVE-2026-111252 (A denial of service vulnerability exists in the XML parsing of
CVE-2026-111235 (An authorization bypass vulnerability exists in the REST API of multip ...)
TODO: check
CVE-2026-111234 (SimplePie through 1.9.0 contains a local file read vulnerability that ...)
- TODO: check
+ NOT-FOR-US: SimplePie
CVE-2026-111233 (Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site ...)
TODO: check
CVE-2026-111232 (Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site sc ...)
@@ -345,13 +345,13 @@ CVE-2026-111172 (@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution
CVE-2026-111171 (Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a ser ...)
TODO: check
CVE-2026-111170 (kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vuln ...)
- TODO: check
+ NOT-FOR-US: kedro-datasets
CVE-2026-111169 (La Suite Docs through 6.0.0 contains an authorization bypass vulnerabi ...)
- TODO: check
+ NOT-FOR-US: La Suite Docs
CVE-2026-111168 (LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vul ...)
- TODO: check
+ NOT-FOR-US: LibreDesk
CVE-2026-111167 (GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vu ...)
- TODO: check
+ - libredwg <itp> (bug #595191)
CVE-2026-111166 (libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerabil ...)
TODO: check
CVE-2026-111165 (libmikmod through 3.3.15 contains a global out-of-bounds read vulnerab ...)
@@ -365,7 +365,7 @@ CVE-2026-111162 (WildMIDI through 0.5.0 contains a heap out-of-bounds read vulne
CVE-2026-111161 (libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-b ...)
TODO: check
CVE-2026-111160 (LightLLM through 1.2.0 contains a denial of service vulnerability that ...)
- TODO: check
+ NOT-FOR-US: LightLLM
CVE-2026-111159 (libewf through 20260924 contains a heap out-of-bounds read vulnerabili ...)
TODO: check
CVE-2026-111158 (EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read v ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/300dd08a7bcb9098a3bea33fbc2b49e08013d9d1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/300dd08a7bcb9098a3bea33fbc2b49e08013d9d1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261015/a301a927/attachment.htm>
More information about the debian-security-tracker-commits
mailing list