[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 16 20:16:23 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d928eb83 by security tracker role at 2026-10-16T19:16:15+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,13 +3,13 @@ CVE-2026-97858 (An attacker can cause the server to unbind the target device fro
CVE-2026-97851 (The storage status-change REST service allows location records still a ...)
TODO: check
CVE-2026-97470 (The Tourfic \u2013 AI Powered Travel Booking, Hotel Booking & Car Rent ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97380 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
TODO: check
CVE-2026-96870 (The SureDash \u2013 Community, Courses & Member Dashboard plugin for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96768 (The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96425 (Incorrect DBus policy for lomiri-download-manager allows arbitrary use ...)
TODO: check
CVE-2026-96424 (Incorrect DBus policy for lomiri-upload-manager (part of lomiri-downlo ...)
@@ -21,9 +21,9 @@ CVE-2026-95183 (An issue in the context-compaction feature of DeepSeek Harness (
CVE-2026-95182 (An untrusted search path in DeepSeek Harness (dsh) commit c291e796 all ...)
TODO: check
CVE-2026-93681 (The Tutor LMS \u2013 eLearning and online course solution plugin for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92766 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92263 (SparkyFitness is a self-hosted, AI-powered health and fitness tracker ...)
TODO: check
CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
@@ -35,7 +35,7 @@ CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd daemon improperly handl
CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically establish conn ...)
TODO: check
CVE-2026-87111 (The User Registration PRO \u2013 Custom Registration Form, Login Form, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86047 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
TODO: check
CVE-2026-86009 (Mailu is a mail server distributed as a set of Docker images. Prior to ...)
@@ -55,15 +55,15 @@ CVE-2026-85745 (MariaDB server is a community developed fork of MySQL server. Fr
CVE-2026-85231 (A flaw was found in libtirpc. An authenticated remote attacker could e ...)
TODO: check
CVE-2026-81452 (Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, con ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-80092 (Authentication bypass by assumed-immutable data in Microsoft Identity ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-77630 (pupnp is an SDK for development of UPnP device and control point appli ...)
TODO: check
CVE-2026-77474 (destructive_command_guard (dcg) is a command-line safety tool that blo ...)
TODO: check
CVE-2026-75903 (The Vulnity Security plugin for WordPress is vulnerable to authenticat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-68908 (libIEC61850 is an open-source implementation of IEC 61850 client and s ...)
TODO: check
CVE-2026-68907 (libIEC61850 is an open-source implementation of IEC 61850 client and s ...)
@@ -71,15 +71,15 @@ CVE-2026-68907 (libIEC61850 is an open-source implementation of IEC 61850 client
CVE-2026-68906 (libIEC61850 is an open-source implementation of IEC 61850 client and s ...)
TODO: check
CVE-2026-68571 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64959 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64610 (Deserialization of Untrusted Data vulnerability in Apache Kylin.Unsafe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-63619 (Missing Authorization vulnerability in Apache Kylin. A backend metadat ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-63618 (Exposure of Sensitive Information (system level configuration info) to ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62362 (PeerBanHelper automatically blocks unwanted, leeching, and abnormal Bi ...)
TODO: check
CVE-2026-59967 (Tandoor Recipes is an application for managing recipes, planning meals ...)
@@ -93,7 +93,7 @@ CVE-2026-57487 (pupnp is an SDK for development of UPnP device and control point
CVE-2026-57486 (pupnp is an SDK for development of UPnP device and control point appli ...)
TODO: check
CVE-2026-57447 (Discourse Doc Categories is a plugin for organizing Discourse topics a ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2026-57446 (libIEC61850 is an open-source implementation of IEC 61850 client and s ...)
TODO: check
CVE-2026-57169 (Dockhand is a Docker management application. Prior to 1.0.34, the in-b ...)
@@ -143,15 +143,15 @@ CVE-2026-18256 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x
CVE-2026-18223 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
TODO: check
CVE-2026-17491 (IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17488 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attack ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17275 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17073 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain se ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17068 (IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NF ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16453 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
TODO: check
CVE-2026-16251 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
@@ -161,7 +161,7 @@ CVE-2026-15575 (Active debug code vulnerability in SFM Software Technologies Inc
CVE-2026-15219 (Authorization bypass through User-Controlled key vulnerability in SFM ...)
TODO: check
CVE-2026-14452 (Improper validation of the reset_url parameter of the Setup in-page se ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-14177 (Observable response discrepancy vulnerability in IKAS Technology Inc. ...)
TODO: check
CVE-2026-111793 (Openwave Webtop Media Transcoder does not enforce administrator-define ...)
@@ -191,11 +191,11 @@ CVE-2026-111714 (tarteaucitron.js before 1.37.0 contains a regular expression de
CVE-2026-111713 (tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnera ...)
TODO: check
CVE-2026-111712 (Netcore NR256CN through 1.5.140116 contains an authentication bypass v ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111711 (Netcore NR256CN through 1.5.140116 contains a pre-authentication stack ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111710 (Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-111709 (WhaTicket Community through commit cf04795 contains an insecure direct ...)
TODO: check
CVE-2026-111708 (WhaTicket Community through commit cf04795 contains an authentication ...)
@@ -367,7 +367,7 @@ CVE-2026-111626 (Webreaper Damselfly through 4.5.3 contains an authentication by
CVE-2026-111625 (10up Distributor before 2.3.2 contains a missing authorization vulnera ...)
TODO: check
CVE-2026-111624 (Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization ...)
- TODO: check
+ NOT-FOR-US: Umbraco CMS
CVE-2026-111623 (Xiaozhi-esp32-server-java through 6.1.0 contains an authentication byp ...)
TODO: check
CVE-2026-111622 (smart-sso through 2.1.1 contains an open redirect vulnerability in the ...)
@@ -419,19 +419,19 @@ CVE-2026-111555 (A flaw was found in luksmeta. Improper boundary validation of m
CVE-2026-111472 (An SQL injection vulnerability has been discovered in TSG Profleet. Th ...)
TODO: check
CVE-2026-111413 (Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111409 (Missing Authorization vulnerability in YITH YITH PayPal Express Checko ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111405 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111400 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111399 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111397 (Missing Authorization vulnerability in PT Norther Lights Production Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111396 (Missing Authorization vulnerability in Liquid Web / StellarWP Advanced ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111392 (SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the m ...)
TODO: check
CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability i ...)
@@ -439,43 +439,43 @@ CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a code injection vulnerab
CVE-2026-111390 (Erupt through 2.3.0 contains an HQL injection vulnerability that allow ...)
TODO: check
CVE-2026-111311 (The DoubleScale | All-in-One CRM \u2013 Sales, Multi-Channel Marketing ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110903 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110901 (Authorization Bypass Through User-Controlled Key vulnerability in WPMU ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110900 (Missing Authorization vulnerability in Liquid Web / StellarWP BookIt b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110896 (Missing Authorization vulnerability in WP Chill Passster content-prote ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110806 (Incorrect authorization in add-on properties in Devolutions Server 202 ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110805 (Server-side request forgery in PingOne groups endpoint in Devolutions ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110804 (Improperly controlled modification of JIT elevation settings in PAM ch ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110703 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110380 (Missing Authorization vulnerability in Arraytics WP Event Solution wp- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110287 (Improper access control in asset contact password in Devolutions Serve ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-110029 (The Squeeze WordPress plugin before 1.8.1 does not perform a capabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109930 (The MAIO WordPress plugin before 7.3.22 does not properly restrict acc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109839 (IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109838 (IBM Db2 Genius Hub1.0 could allow a local attacker to obtain sensitive ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109588 (Numeric truncation of the buffer length in the MPU buffer authorizatio ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109587 (Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU po ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-109461 (Origin validation error in Microsoft Authentication Library (MSAL) for ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-109224 (The SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109119 (Improper Privilege Management in the user management API endpoint (/ap ...)
TODO: check
CVE-2026-109118 (Improper path containment check in ikus060 rdiffweb 7.1.1 allows an au ...)
@@ -483,11 +483,11 @@ CVE-2026-109118 (Improper path containment check in ikus060 rdiffweb 7.1.1 allow
CVE-2026-107777 (Thermo Fisher Torrent Suite Softwareis vulnerable to a path traversal, ...)
TODO: check
CVE-2026-107674 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to D ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107649 (The Events Made Easy plugin for WordPress is vulnerable to Stored Cros ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107648 (The WP Sessions Time Monitoring Full Automatic plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107621 (JPEGParser can enter an infinite loop while parsing a specially crafte ...)
TODO: check
CVE-2026-107617 (An attacker can use a hard-coded credential to log in to EseeCloud dev ...)
@@ -511,31 +511,31 @@ CVE-2026-105279 (In the default configuration, the archive accepts DICOM associa
CVE-2026-105273 (MP4Parser does not adequately validate MP4 box sizes. A malformed box ...)
TODO: check
CVE-2026-104726 (The Name Directory plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104003 (The WP User Avatar / ProfilePress plugin for WordPress is vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102941 (The package github.com/gomarkdown/markdown is a Go library for parsing ...)
TODO: check
CVE-2026-102923 (SparkyFitness is a self-hosted, AI-powered health and fitness tracker ...)
TODO: check
CVE-2026-102917 (IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102693 (RIOT is an open-source microcontroller operating system designed for I ...)
TODO: check
CVE-2026-102692 (RIOT is an open-source microcontroller operating system designed for I ...)
TODO: check
CVE-2026-102552 (Improper verification of the source of a communication channel in the ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-102551 (Improper verification of the source of a communication channel in the ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-101300 (Server-Side Request Forgery (SSRF) reported in the ticket sales chart ...)
TODO: check
CVE-2026-101021 (MultipartInputStream performs inefficient boundary matching and unnece ...)
TODO: check
CVE-2026-100108 (The Social Share Buttons plugin for WordPress is vulnerable to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100106 (The FiboSearch \u2013 Ajax Search for WooCommerce plugin for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-66969 (Integer overflow in OpenModSim (<=1.11.0), leading to denial of servic ...)
TODO: check
CVE-2025-55653 (GPAC MP4Box v2.4 was discovered to contain a floating point exception ...)
@@ -1848,11 +1848,11 @@ CVE-2025-29897 (A buffer copy without checking size of input vulnerability has b
CVE-2025-29896 (A NULL pointer dereference vulnerability has been reported to affect Q ...)
NOT-FOR-US: QNAP
CVE-2025-23390 (A vulnerability has been identified within Fleet where, by default, Fl ...)
- TODO: check
+ NOT-FOR-US: SUSE
CVE-2024-22031 (A vulnerability has been identified within Rancher where a user with t ...)
NOT-FOR-US: SUSE
CVE-2023-32198 (A vulnerability has been identified in Steve where by default it was u ...)
- TODO: check
+ NOT-FOR-US: SUSE
CVE-2026-99999 (In the Linux kernel, the following vulnerability has been resolved: i ...)
{DSA-6568-1}
- linux 7.2.11-1
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d928eb830afde49c6ed06ce48ed89a8e4b7d83c3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d928eb830afde49c6ed06ce48ed89a8e4b7d83c3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/cdf702c3/attachment.htm>
More information about the debian-security-tracker-commits
mailing list