[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 17 11:15:32 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fe99e2cd by Salvatore Bonaccorso at 2026-10-17T12:15:15+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -79,13 +79,13 @@ CVE-2026-17591 (A flaw was found in libarchive. An attacker can cause a Denial o
NOTE: https://github.com/libarchive/libarchive/pull/3318
NOTE: Fixed by: https://github.com/mmatuska/libarchive/commit/45f7ec5422e7677673a7da1ae9ae2ac2b5721204 (v3.8.9)
CVE-2026-111855 (An issue was discovered on Tektronix 3 Series MDO devices before 1.21. ...)
- TODO: check
+ NOT-FOR-US: Tektronix
CVE-2026-111854 (An issue was discovered on Tektronix 3 Series MDO devices before 1.21. ...)
- TODO: check
+ NOT-FOR-US: Tektronix
CVE-2026-111853 (An issue was discovered on Tektronix 3 Series MDO devices before 1.21. ...)
- TODO: check
+ NOT-FOR-US: Tektronix
CVE-2026-111823 (Mage OSS through 0.9.80 before 76c4f46 can proceed with session creati ...)
- TODO: check
+ NOT-FOR-US: Mage OSS
CVE-2026-111802 (A flaw was found in Nautilus. When a removable drive or disk image is ...)
TODO: check
CVE-2026-111726 (The Themify Builder plugin for WordPress is vulnerable to Stored Cross ...)
@@ -95,7 +95,7 @@ CVE-2026-111602 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Sc
CVE-2026-111601 (The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerab ...)
NOT-FOR-US: WordPress plugin
CVE-2026-111044 (Sunshine is a self-hosted game stream host for Moonlight. From 2026.32 ...)
- TODO: check
+ NOT-FOR-US: Sunshine
CVE-2026-110653 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110527 (The WP User Manager WordPress plugin before 2.9.20 does not roll back ...)
@@ -638,39 +638,39 @@ CVE-2026-111621 (TDuck Survey Form through 5.3 contains a missing authorization
CVE-2026-111620 (O2OA through 10.0.2-ce contains an authorization bypass vulnerability ...)
NOT-FOR-US: O2OA
CVE-2026-111619 (FilePress through 3.0.1 contains an sql injection vulnerability that a ...)
- TODO: check
+ NOT-FOR-US: FilePress
CVE-2026-111618 (CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path travers ...)
- TODO: check
+ NOT-FOR-US: CoAI (Chat Nio)
CVE-2026-111617 (WHartTest through 2.8.1 contains a missing authentication vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WHartTest
CVE-2026-111616 (Oqtane Framework through 10.2.6 contains an authorization bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Oqtane Framework
CVE-2026-111615 (Mall4cloud through 4.0 contains an insecure direct object reference vu ...)
- TODO: check
+ NOT-FOR-US: Mall4cloud
CVE-2026-111614 (DataCap through 2025.1.1 contains an insecure direct object reference ...)
- TODO: check
+ NOT-FOR-US: DataCap
CVE-2026-111613 (AllData through 0.7.1 contains an unauthenticated JDBC injection vulne ...)
- TODO: check
+ NOT-FOR-US: AllData
CVE-2026-111612 (netdisk-fast-download through 0.4.8 contains an information disclosure ...)
- TODO: check
+ NOT-FOR-US: netdisk-fast-download
CVE-2026-111611 (roncoo-education through 25.0.0-RELEASE contains an insecure direct ob ...)
- TODO: check
+ NOT-FOR-US: roncoo-education
CVE-2026-111610 (B3log Solo through 4.4.0 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: B3log Solo
CVE-2026-111609 (PKP Open Journal Systems through 3.5.0-5 contains an insecure direct o ...)
- TODO: check
+ NOT-FOR-US: PKP Open Journal Systems
CVE-2026-111608 (Jeepay through 3.2.9 contains an insecure direct object reference vuln ...)
- TODO: check
+ NOT-FOR-US: Jeepay
CVE-2026-111607 (Jeepay through 3.2.9 contains an insecure direct object reference vuln ...)
- TODO: check
+ NOT-FOR-US: Jeepay
CVE-2026-111606 (Huly Platform through 0.7.432 contains a missing authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: Huly Platform
CVE-2026-111605 (Jpom through 2.11.12 contains an authorization bypass vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Jpom
CVE-2026-111604 (eladmin through 2.7 contains an authorization bypass vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: eladmin
CVE-2026-111603 (PlayEdu through 2.3 contains a missing authorization vulnerability in ...)
- TODO: check
+ NOT-FOR-US: PlayEdu
CVE-2026-111593
REJECTED
CVE-2026-111581 (A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_ ...)
@@ -678,7 +678,7 @@ CVE-2026-111581 (A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and
CVE-2026-111555 (A flaw was found in luksmeta. Improper boundary validation of metadata ...)
TODO: check
CVE-2026-111472 (An SQL injection vulnerability has been discovered in TSG Profleet. Th ...)
- TODO: check
+ NOT-FOR-US: TSG Profleet
CVE-2026-111413 (Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111409 (Missing Authorization vulnerability in YITH YITH PayPal Express Checko ...)
@@ -694,9 +694,9 @@ CVE-2026-111397 (Missing Authorization vulnerability in PT Norther Lights Produc
CVE-2026-111396 (Missing Authorization vulnerability in Liquid Web / StellarWP Advanced ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111392 (SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the m ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-111391 (SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability i ...)
- TODO: check
+ NOT-FOR-US: SGLang
CVE-2026-111390 (Erupt through 2.3.0 contains an HQL injection vulnerability that allow ...)
NOT-FOR-US: Erupt
CVE-2026-111311 (The DoubleScale | All-in-One CRM \u2013 Sales, Multi-Channel Marketing ...)
@@ -985,57 +985,57 @@ CVE-2026-111350 (Papermark through 0.22.0 contains a missing authorization vulne
CVE-2026-111349 (Craftplan through 0.7.5 contains a missing authorization vulnerability ...)
NOT-FOR-US: Craftplan
CVE-2026-111348 (Likeshop through 3.5.1 contains an insecure direct object reference vu ...)
- TODO: check
+ NOT-FOR-US: Likeshop
CVE-2026-111347 (go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, publi ...)
- TODO: check
+ NOT-FOR-US: opsre go-ldap-admin
CVE-2026-111346 (ZenTao PMS through 22.6 contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: ZenTao PMS
CVE-2026-111345 (Trudesk through 1.2.11 contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: Trudesk
CVE-2026-111344 (APITable through 1.14.0-beta contains an authorization bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: APITable
CVE-2026-111343 (pig through 4.1.1 contains a missing authorization vulnerability in Sy ...)
- TODO: check
+ NOT-FOR-US: pig-mesh Pig
CVE-2026-111332 (OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulne ...)
- TODO: check
+ NOT-FOR-US: OxiCloud
CVE-2026-111331 (Dokploy through 0.30.8 contains a cross-organization authorization byp ...)
- TODO: check
+ NOT-FOR-US: Dokploy
CVE-2026-111330 (JuggleIM im-server through 1.8.16 contains a weak password hashing vul ...)
- TODO: check
+ NOT-FOR-US: JuggleIM im-server
CVE-2026-111329 (JuggleIM im-server through 1.8.16 ships default administrator credenti ...)
- TODO: check
+ NOT-FOR-US: JuggleIM im-server
CVE-2026-111324 (rustdesk-api through 2.7 contains an authorization bypass vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: rustdesk-api
CVE-2026-111323 (RedAmon through 7.0.1 contains an unauthenticated server-side request ...)
- TODO: check
+ NOT-FOR-US: RedAmon
CVE-2026-111322 (Archon 0.2.13 through 0.11.1 contains a missing authentication vulnera ...)
- TODO: check
+ NOT-FOR-US: Archon
CVE-2026-111321 (TaskingAI through 0.3.0 contains a server-side request forgery vulnera ...)
- TODO: check
+ NOT-FOR-US: TaskingAI
CVE-2026-111320 (ValueCell through 0.1.20 contains an unauthenticated server-side reque ...)
- TODO: check
+ NOT-FOR-US: ValueCell
CVE-2026-111313 (JobOps through 0.13.1 contains a server-side request forgery vulnerabi ...)
- TODO: check
+ NOT-FOR-US: JobOps
CVE-2026-111312 (OpenHealth through 0.2.0 contains a missing authentication and authori ...)
- TODO: check
+ NOT-FOR-US: OpenHealth
CVE-2026-111284 (Aureus ERP through 1.6.0 contains a stored cross-site scripting vulner ...)
- TODO: check
+ NOT-FOR-US: Aureus ERP
CVE-2026-111283 (BMC Helix Network Management on-prem before 26.3.01 contains an authen ...)
- TODO: check
+ NOT-FOR-US: BMC Helix Network Management on-prem
CVE-2026-111282 (Driftregion iso14229 before 0.10.1 contains an integer wraparound in H ...)
- TODO: check
+ NOT-FOR-US: Driftregion iso14229
CVE-2026-111281 (Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 co ...)
- TODO: check
+ NOT-FOR-US: Jooan JA-A12 IP cameras
CVE-2026-111280 (snap7 through 1.4.3 contains an out-of-bounds write vulnerability in T ...)
- TODO: check
+ NOT-FOR-US: snap7
CVE-2026-111279 (Dragonfly through 2.0.2 contains an unbounded memory allocation vulner ...)
- TODO: check
+ NOT-FOR-US: Dragonfly
CVE-2026-111278 (NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that al ...)
- TODO: check
+ NOT-FOR-US: NivoCart
CVE-2026-111277 (NivoCart through 2.5.1 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: NivoCart
CVE-2026-111275 (nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and ...)
- TODO: check
+ NOT-FOR-US: nifti_clib
CVE-2026-111274 (unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_pa ...)
- unarr <undetermined>
CVE-2026-111273 (unarr through 1.1.1 contains an off-by-one heap-based buffer overflow ...)
@@ -1834,11 +1834,11 @@ CVE-2026-110812 (Deserialization of untrusted data in the Gremlin graph data imp
CVE-2026-110746 (A local privilege escalation vulnerability in TotalAV allows an unpriv ...)
NOT-FOR-US: TotalAV
CVE-2026-110726 (In `api-gateway` versions till `1.7.3`, The default rate-limit key res ...)
- TODO: check
+ NOT-FOR-US: api-gateway
CVE-2026-110724 (In `api-gateway` versions till `1.7.3`, The default rate-limit key res ...)
- TODO: check
+ NOT-FOR-US: api-gateway
CVE-2026-110723 (In `api-gateway` versions till `1.7.3`, The default rate-limit key res ...)
- TODO: check
+ NOT-FOR-US: api-gateway
CVE-2026-110381 (Authorization Bypass Through User-Controlled Key vulnerability in NSqu ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110378 (Missing Authorization vulnerability in WP E-Signature Ninja Forms Sign ...)
@@ -2385,19 +2385,19 @@ CVE-2026-110698 (A security vulnerability has been detected in Praat up to 7.0.0
CVE-2026-110696 (A weakness has been identified in itsmeravitejak Online-Examination-Sy ...)
NOT-FOR-US: itsmeravitejak Online-Examination-System
CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affec ...)
- TODO: check
+ NOT-FOR-US: turboderp ExLlamaV2
CVE-2026-110694 (A vulnerability has been found in OAID Tengine up to 1.12.0. This vuln ...)
- TODO: check
+ NOT-FOR-US: OAID Tengine
CVE-2026-110689 (A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. ...)
NOT-FOR-US: OpenClaw
CVE-2026-110679 (A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impa ...)
TODO: check
CVE-2026-110670 (A vulnerability was found in cemtan sar2html 4.0.0. The affected eleme ...)
- TODO: check
+ NOT-FOR-US: cemtan sar2html
CVE-2026-110669 (A security vulnerability has been detected in cemtan sar2html 4.0.0. T ...)
- TODO: check
+ NOT-FOR-US: cemtan sar2html
CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0. Affected by t ...)
- TODO: check
+ NOT-FOR-US: cemtan sar2html
CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket can forc ...)
NOT-FOR-US: Amazon
CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entit ...)
@@ -2921,7 +2921,7 @@ CVE-2026-110765 (FlexPrice through 2.1.38 contains an authentication bypass vuln
CVE-2026-110764 (AstronRPA through 1.1.6 contains an insecure direct object reference v ...)
NOT-FOR-US: AstronRPA
CVE-2026-110763 (lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure dir ...)
- TODO: check
+ NOT-FOR-US: lamp-boot
CVE-2026-110762 (bbPress before 2.6.19 contains an information disclosure vulnerability ...)
NOT-FOR-US: bbPress
CVE-2026-110761 (ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vul ...)
@@ -2944,7 +2944,7 @@ CVE-2026-110734 (Godot Engine through 4.7.2 has a heap out-of-bounds write in th
CVE-2026-110719 (Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side reques ...)
NOT-FOR-US: Portkey AI Gateway
CVE-2026-110718 (TurboDocx html-to-docx through 1.23.1 contains a server-side request f ...)
- TODO: check
+ NOT-FOR-US: TurboDocx html-to-docx
CVE-2026-110717 (Janus WebRTC Server through 1.4.3 contains a path traversal vulnerabil ...)
- janus <undetermined>
CVE-2026-110716 (unshield through 1.6.2 contains a heap out-of-bounds read vulnerabilit ...)
@@ -2958,21 +2958,21 @@ CVE-2026-110713 (libsmb2 through 6.2 contains a heap out-of-bounds read vulnerab
CVE-2026-110712 (libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability i ...)
TODO: check
CVE-2026-110690 (Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a ...)
- TODO: check
+ NOT-FOR-US: Cloud Commander (cloudcmd)
CVE-2026-110667 (A security flaw has been discovered in cemtan sar2html 4.0.0. Affected ...)
- TODO: check
+ NOT-FOR-US: cemtan sar2html
CVE-2026-110666 (A vulnerability was identified in cemtan sar2html 4.0.0. Affected is t ...)
- TODO: check
+ NOT-FOR-US: cemtan sar2html
CVE-2026-110661 (CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability i ...)
- TODO: check
+ NOT-FOR-US: CGNS
CVE-2026-110660 (vgmstream through r2117 contains a stack out-of-bounds read vulnerabil ...)
- TODO: check
+ NOT-FOR-US: vgmstream
CVE-2026-110659 (ELFIO through 3.12 contains a NULL pointer dereference vulnerability i ...)
- TODO: check
+ NOT-FOR-US: ELFIO
CVE-2026-110658 (Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerabi ...)
TODO: check
CVE-2026-110657 (Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 c ...)
- TODO: check
+ NOT-FOR-US: Khronos NNEF-Tools nnef
CVE-2026-110656 (miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vu ...)
TODO: check
CVE-2026-110655 (miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vu ...)
@@ -2980,38 +2980,38 @@ CVE-2026-110655 (miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds
CVE-2026-110654 (libzvbi through 0.2.45 contains an out-of-bounds write vulnerability i ...)
TODO: check
CVE-2026-110652 (ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated se ...)
- TODO: check
+ NOT-FOR-US: ONLYOFFICE
CVE-2026-110650 (The thumbnail Python package through 1.5 contains an OS command inject ...)
- TODO: check
+ NOT-FOR-US: thumbnail Python package
CVE-2026-110649 (Stills before 25.24.2 contains an OS command injection vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Stills
CVE-2026-110648 (@offactory/compress-fonts before 1.1.1 contains an OS command injectio ...)
- TODO: check
+ NOT-FOR-US: offactory/compress-fonts
CVE-2026-110647 (Turnpress through 0.4.2 contains an OS command injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: Turnpress
CVE-2026-110646 (Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command inje ...)
- TODO: check
+ NOT-FOR-US: Beganovich snappdf
CVE-2026-110645 (Video-stitch before 2.0.0-beta.1 contains an OS command injection vuln ...)
- TODO: check
+ NOT-FOR-US: Video-stitch
CVE-2026-110644 (nodejs-whisper through 0.3.1 contains an OS command injection vulnerab ...)
- TODO: check
+ NOT-FOR-US: nodejs-whisper
CVE-2026-110643 (transcribe2texts through 1.0.6 contains an OS command injection vulner ...)
- TODO: check
+ NOT-FOR-US: transcribe2texts
CVE-2026-110642 (xhtml2pdf before 0.2.19 contains an OS command injection vulnerability ...)
- xhtml2pdf <unfixed> (unimportant)
NOTE: https://github.com/xhtml2pdf/xhtml2pdf/commit/654f0de6ff4995eb058bfdf55dfa8ae4e4e3f154 (v0.2.21)
NOTE: https://github.com/xhtml2pdf/xhtml2pdf/pull/835
NOTE: Negligible security impact
CVE-2026-110641 (@runnerty/executor-decompress through 3.1.1 contains an OS command inj ...)
- TODO: check
+ NOT-FOR-US: runnerty/executor-decompress
CVE-2026-110640 (Whisper-node through 1.1.1 contains an OS command injection vulnerabil ...)
- TODO: check
+ NOT-FOR-US: nodejs-whisper
CVE-2026-110639 (@mborne/extract before 0.2.1 contains an OS command injection vulnerab ...)
- TODO: check
+ NOT-FOR-US: mborne/extract
CVE-2026-110638 (doc-recog through 1.1.6 contains an OS command injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: doc-recog
CVE-2026-110637 (buildebooks before 0.2.2 contains an OS command injection vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: buildebooks
CVE-2026-110636 (pypdftk through 0.5 contains an OS command injection vulnerability in ...)
TODO: check
CVE-2026-110635 (webp-converter before 3.0.0 contains an OS command injection vulnerabi ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe99e2cd59985fb0b66e5c7b3001a45d6d5c425e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fe99e2cd59985fb0b66e5c7b3001a45d6d5c425e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/df0c86be/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list