[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 16 23:03:45 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
416b047a by Moritz Muehlenhoff at 2026-10-17T00:03:22+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -38,7 +38,7 @@ CVE-2026-92263 (SparkyFitness is a self-hosted, AI-powered health and fitness tr
CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
TODO: check
CVE-2026-90821 (An input neutralization vulnerability in the Webhook URL form field co ...)
- TODO: check
+ NOT-FOR-US: Crafty Controller
CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd daemon improperly handles inp ...)
TODO: check
CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically establish conn ...)
@@ -156,7 +156,7 @@ CVE-2026-18799 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x
CVE-2026-18560 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-18516 (An output escaping vulnerability in the Audit Logs component of Crafty ...)
- TODO: check
+ NOT-FOR-US: Crafty Controller
CVE-2026-18256 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
- mattermost-server <itp> (bug #823556)
CVE-2026-18223 (Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11 ...)
@@ -328,73 +328,73 @@ CVE-2026-111655 (ThinkAdmin think-plugs-admin through 1.0.81 contains an insecur
CVE-2026-111654 (FastBee through 2.1.0 contains an insecure direct object reference vul ...)
NOT-FOR-US: FastBee
CVE-2026-111653 (53AIHub through 0.5.3 contains a missing authentication vulnerability ...)
- TODO: check
+ NOT-FOR-US: 53AIHub
CVE-2026-111652 (Engineercms through 2.0.5 contains a missing authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Engineercms
CVE-2026-111651 (Risesoft Digital-Infrastructure through 9.6.11 contains a missing auth ...)
- TODO: check
+ NOT-FOR-US: Risesoft Digital-Infrastructure
CVE-2026-111650 (ChronoFrame through 1.0.0 contains a missing authentication vulnerabil ...)
- TODO: check
+ NOT-FOR-US: ChronoFrame
CVE-2026-111649 (Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct ob ...)
- TODO: check
+ NOT-FOR-US: Rocboss paopao-ce
CVE-2026-111648 (BuildAdmin through 2.3.9 contains an insecure direct object reference ...)
- TODO: check
+ NOT-FOR-US: BuildAdmin
CVE-2026-111647 (PickMall lilishop through 5.0.0 contains an insecure direct object ref ...)
- TODO: check
+ NOT-FOR-US: PickMall lilishop
CVE-2026-111646 (SurveyKing before 1.13.0 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: SurveyKing
CVE-2026-111645 (MrDoc through 1.1.1 contains a missing object-level authorization vuln ...)
- TODO: check
+ NOT-FOR-US: MrDoc
CVE-2026-111644 (Misaka Danmu Server through 2.8.9 contains a missing authentication vu ...)
- TODO: check
+ NOT-FOR-US: Misaka Danmu Server
CVE-2026-111643 (Misaka Danmu Server through 2.8.9 contains an authentication bypass vu ...)
- TODO: check
+ NOT-FOR-US: Misaka Danmu Server
CVE-2026-111642 (FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in b ...)
- TODO: check
+ NOT-FOR-US: FastapiAdmin
CVE-2026-111641 (FastapiAdmin through 3.0 contains an authentication bypass vulnerabili ...)
- TODO: check
+ NOT-FOR-US: FastapiAdmin
CVE-2026-111640 (DooTask through 1.9.66 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: DooTask
CVE-2026-111639 (bbs-go through 4.4.6 contains an authentication bypass vulnerability i ...)
- TODO: check
+ NOT-FOR-US: bbs-gosk
CVE-2026-111638 (sshportal through 1.19.5 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: sshportal
CVE-2026-111637 (NexoPOS through 6.2.4 contains a missing authentication vulnerability ...)
- TODO: check
+ NOT-FOR-US: NexoPOS
CVE-2026-111636 (OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vuln ...)
- TODO: check
+ NOT-FOR-US: OpenBMB
CVE-2026-111635 (Helical Insight through 7.0.0 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Helical Insight
CVE-2026-111634 (Helical Insight through 7.0.0 contains an sql injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: Helical Insight
CVE-2026-111633 (ZKEACMS through 4.4 contains an authentication bypass vulnerability th ...)
- TODO: check
+ NOT-FOR-US: ZKEACMS
CVE-2026-111632 (Aureus ERP through 1.6.0 contains an authorization bypass vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Aureus ERP
CVE-2026-111631 (Distributor before 2.3.2 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Distributor
CVE-2026-111630 (abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct objec ...)
- TODO: check
+ NOT-FOR-US: abp-next-admin
CVE-2026-111629 (IoTSharp through 3.6.1 contains an insecure direct object reference vu ...)
- TODO: check
+ NOT-FOR-US: IoTSharp
CVE-2026-111628 (10up Distributor before 2.3.2 contains a PHP object injection vulnerab ...)
- TODO: check
+ NOT-FOR-US: Distributor
CVE-2026-111627 (HestiaCP before 1.10.5 contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: HestiaCP
CVE-2026-111626 (Webreaper Damselfly through 4.5.3 contains an authentication bypass vu ...)
- TODO: check
+ NOT-FOR-US: Webreaper Damselfly
CVE-2026-111625 (10up Distributor before 2.3.2 contains a missing authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Distributor
CVE-2026-111624 (Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization ...)
NOT-FOR-US: Umbraco CMS
CVE-2026-111623 (Xiaozhi-esp32-server-java through 6.1.0 contains an authentication byp ...)
- TODO: check
+ NOT-FOR-US: Xiaozhi-esp32-server-java
CVE-2026-111622 (smart-sso through 2.1.1 contains an open redirect vulnerability in the ...)
- TODO: check
+ NOT-FOR-US: smart-sso
CVE-2026-111621 (TDuck Survey Form through 5.3 contains a missing authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: TDuck Survey Form
CVE-2026-111620 (O2OA through 10.0.2-ce contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: O2OA
CVE-2026-111619 (FilePress through 3.0.1 contains an sql injection vulnerability that a ...)
TODO: check
CVE-2026-111618 (CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path travers ...)
@@ -548,21 +548,21 @@ CVE-2026-102552 (Improper verification of the source of a communication channel
CVE-2026-102551 (Improper verification of the source of a communication channel in the ...)
NOT-FOR-US: Amazon
CVE-2026-101300 (Server-Side Request Forgery (SSRF) reported in the ticket sales chart ...)
- TODO: check
+ NOT-FOR-US: Wegow
CVE-2026-101021 (MultipartInputStream performs inefficient boundary matching and unnece ...)
- TODO: check
+ NOT-FOR-US: dcm4chee-arc-light
CVE-2026-100108 (The Social Share Buttons plugin for WordPress is vulnerable to Stored ...)
NOT-FOR-US: WordPress plugin
CVE-2026-100106 (The FiboSearch \u2013 Ajax Search for WooCommerce plugin for WordPress ...)
NOT-FOR-US: WordPress plugin
CVE-2025-66969 (Integer overflow in OpenModSim (<=1.11.0), leading to denial of servic ...)
- TODO: check
+ NOT-FOR-US: OpenModSim
CVE-2025-55653 (GPAC MP4Box v2.4 was discovered to contain a floating point exception ...)
- gpac <removed>
CVE-2025-55640 (A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_wri ...)
- gpac <removed>
CVE-2025-52097 (Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET ...)
- TODO: check
+ NOT-FOR-US: InstantASP
CVE-2026-XXXX [ZSA-2026-16]
- znuny 6.5.26-1
[trixie] - znuny <no-dsa> (Non-free not supported)
@@ -733,15 +733,15 @@ CVE-2026-111355 (zhontai Admin.Core through 10.1.0 contains an authorization byp
CVE-2026-111354 (crmeb_java through 3.1 contains an authorization bypass vulnerability ...)
NOT-FOR-US: crmeb_java
CVE-2026-111353 (Peppermint through 0.5.5 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Peppermint
CVE-2026-111352 (ThinkCMF through 8.0.1 contains an incorrect authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: ThinkCMF
CVE-2026-111351 (metasfresh through 5.175 contains a missing record-level authorization ...)
- TODO: check
+ NOT-FOR-US: metasfresh
CVE-2026-111350 (Papermark through 0.22.0 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Papermark
CVE-2026-111349 (Craftplan through 0.7.5 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: Craftplan
CVE-2026-111348 (Likeshop through 3.5.1 contains an insecure direct object reference vu ...)
TODO: check
CVE-2026-111347 (go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, publi ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/416b047a5d61090aa92d3d2d1acf76a28285d4f5
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/416b047a5d61090aa92d3d2d1acf76a28285d4f5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/73ee23bc/attachment.htm>
More information about the debian-security-tracker-commits
mailing list