[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 16 06:05:42 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eeb716d5 by Salvatore Bonaccorso at 2026-10-16T07:05:22+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -27,13 +27,13 @@ CVE-2026-94621 (AliasVault is a privacy-first password manager with built-in ema
 CVE-2026-93649 (In the Eclipse Adoptium website (adoptium.net), in every deployment bu ...)
 	TODO: check
 CVE-2026-92982 (A flaw was found in Ansible Operator Plugins. A low-privileged Kuberne ...)
-	TODO: check
+	NOT-FOR-US: Red Hat Ansible Operator Plugins
 CVE-2026-92707 (MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.30 ...)
-	TODO: check
+	NOT-FOR-US: MessagePack-CSharp
 CVE-2026-8145 (The WholesaleX \u2013 B2B & Wholesale Plugin for WooCommerce with Whol ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity (XXE) inject ...)
-	TODO: check
+	NOT-FOR-US: Enterprise Architect
 CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extra ...)
 	TODO: check
 CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
@@ -174,13 +174,13 @@ CVE-2026-55840 (Scoold is a Q&A and a knowledge sharing platform for teams. Prio
 CVE-2026-55587 (AliasVault is a privacy-first password manager with built-in email ali ...)
 	NOT-FOR-US: AliasVault
 CVE-2026-55414 (NL Portal Backend Libraries provide backend components for Dutch gover ...)
-	TODO: check
+	NOT-FOR-US: NL Portal Backend Libraries
 CVE-2026-55246 (bincookie is a header-only binarycookies parser. Prior to 0.1.9, binco ...)
-	TODO: check
+	NOT-FOR-US: bincookie
 CVE-2026-55240 (Tianji is an open source analytics, uptime monitoring, and server stat ...)
-	TODO: check
+	NOT-FOR-US: Tianji
 CVE-2026-55239 (Tianji is an open source analytics, uptime monitoring, and server stat ...)
-	TODO: check
+	NOT-FOR-US: Tianji
 CVE-2026-55184 (EspoCRM is an open source customer relationship management application ...)
 	NOT-FOR-US: EspoCRM
 CVE-2026-55154 (EspoCRM is an open source customer relationship management application ...)
@@ -188,7 +188,7 @@ CVE-2026-55154 (EspoCRM is an open source customer relationship management appli
 CVE-2026-55103 (Discourse ActivityPub adds ActivityPub support to Discourse. Prior to  ...)
 	NOT-FOR-US: Discourse
 CVE-2026-54683 (NL Portal Backend Libraries provide backend components for Dutch gover ...)
-	TODO: check
+	NOT-FOR-US: NL Portal Backend Libraries
 CVE-2026-53882 (An improper link resolution before file access ('link following') vuln ...)
 	NOT-FOR-US: QNAP
 CVE-2026-53582 (OPNsense is a FreeBSD based firewall and routing platform. Prior to ve ...)
@@ -208,7 +208,7 @@ CVE-2026-47790 (A cross-site scripting (XSS) vulnerability has been reported to
 CVE-2026-47786 (An OS command injection vulnerability has been reported to affect Hybr ...)
 	NOT-FOR-US: QNAP
 CVE-2026-47218 (runwasi facilitates running Wasm and WASI workloads managed by contain ...)
-	TODO: check
+	NOT-FOR-US: runwasi
 CVE-2026-47168 (EspoCRM is an open source customer relationship management application ...)
 	NOT-FOR-US: EspoCRM
 CVE-2026-46708 (EspoCRM is an open source customer relationship management application ...)
@@ -242,7 +242,7 @@ CVE-2026-39991 (A cross-site scripting (XSS) vulnerability has been reported to
 CVE-2026-39989 (A server-side request forgery (SSRF) vulnerability has been reported t ...)
 	NOT-FOR-US: QNAP
 CVE-2026-35088 (Slican telephone exchangesuse symmetric encryption for TCP/IP communic ...)
-	TODO: check
+	NOT-FOR-US: Slican telephone exchanges
 CVE-2026-34015 (A path traversal vulnerability has been reported to affect Video Stati ...)
 	NOT-FOR-US: QNAP
 CVE-2026-34014 (An incorrect permission assignment for critical resource vulnerability ...)
@@ -296,55 +296,55 @@ CVE-2026-16437 (Weak Password Recovery Mechanism for Forgotten Password vulnerab
 CVE-2026-16436 (Weak Password Recovery Mechanism for Forgotten Password vulnerability  ...)
 	NOT-FOR-US: Mitsubishi
 CVE-2026-111252 (A denial of service vulnerability exists in the XML parsing of multipl ...)
-	TODO: check
+	NOT-FOR-US: OpenNMS
 CVE-2026-111235 (An authorization bypass vulnerability exists in the REST API of multip ...)
-	TODO: check
+	NOT-FOR-US: OpenNMS
 CVE-2026-111234 (SimplePie through 1.9.0 contains a local file read vulnerability that  ...)
 	NOT-FOR-US: SimplePie
 CVE-2026-111233 (Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111232 (Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site sc ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111231 (Netgate pfSense CE through 2.9.0 contains an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111230 (Netgate pfSense CE through 2.9.0 contains a local file read vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111229 (pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111228 (Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection  ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111227 (Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111226 (pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulner ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111225 (Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injectio ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111224 (pfSense CE through 2.9.0 contains an OS command injection vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111223 (Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration inject ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111222 (Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerab ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111221 (Netgate pfSense CE through 2.9.0 contains a configuration injection vu ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111220 (pfSense CE through 2.9.0 contains a crontab injection vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111219 (Netgate pfSense CE through 2.9.0 contains a newline injection vulnerab ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111218 (Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injectio ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111217 (Netgate pfSense CE through 2.9.0 contains an OS command injection vuln ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111216 (Netgate pfSense CE through 2.9.0 contains an OS command injection vuln ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111215 (Netgate pfSense CE through 2.9.0 contains an OS command injection vuln ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111214 (Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injectio ...)
-	TODO: check
+	NOT-FOR-US: pfSense
 CVE-2026-111172 (@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulner ...)
-	TODO: check
+	NOT-FOR-US: casl/ability
 CVE-2026-111171 (Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a ser ...)
-	TODO: check
+	NOT-FOR-US: web3.py
 CVE-2026-111170 (kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vuln ...)
 	NOT-FOR-US: kedro-datasets
 CVE-2026-111169 (La Suite Docs through 6.0.0 contains an authorization bypass vulnerabi ...)
@@ -472,7 +472,7 @@ CVE-2026-110890 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-110888 (Missing Authorization vulnerability in Meow Apps AI Engine ai-engine a ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-110878 (Aureus ERP through 1.6.0 contains a stored cross-site scripting vulner ...)
-	TODO: check
+	NOT-FOR-US: Aureus ERP
 CVE-2026-110877 (AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in ...)
 	TODO: check
 CVE-2026-110876 (AdPlug through 2.4 contains an out-of-bounds read vulnerability in src ...)
@@ -906,9 +906,9 @@ CVE-2026-110923 (A flaw was found in OpenSSH. During an sftp copy, a malicious s
 CVE-2026-110912 (In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers  ...)
 	NOT-FOR-US: DragonFly BSD
 CVE-2026-110911 (Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied q ...)
-	TODO: check
+	NOT-FOR-US: Wheels
 CVE-2026-110909 (Wheels CLI through 4.1.0 does not verify that the local development se ...)
-	TODO: check
+	NOT-FOR-US: Wheels
 CVE-2026-110908 (Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revis ...)
 	NOT-FOR-US: Netgate pfSense FRR package (pfSense-pkg-frr)
 CVE-2026-110907 (Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishan ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eeb716d51acd2c0c2127b0d568cce945c6d2028d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/eeb716d51acd2c0c2127b0d568cce945c6d2028d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/45100921/attachment.htm>

More information about the debian-security-tracker-commits mailing list