[Git][security-tracker-team/security-tracker][master] Process more NFUs

Sat Oct 17 14:06:06 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d19241f7 by Salvatore Bonaccorso at 2026-10-17T15:05:48+02:00
Process more NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1986,11 +1986,11 @@ CVE-2026-108082 (Symfony is a PHP framework for web and console applications and
 CVE-2026-107416 (Authorization Bypass Through User-Controlled Key vulnerability in Webb ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106707 (XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS)  ...)
-	TODO: check
+	NOT-FOR-US: XXL-JOB
 CVE-2026-106706 (XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scri ...)
-	TODO: check
+	NOT-FOR-US: XXL-JOB
 CVE-2026-106701 (ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) vi ...)
-	TODO: check
+	NOT-FOR-US: ELADMIN
 CVE-2026-106604 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-106163 (In Progress\xae Kendo\xae UI for jQuery versions starting with v2023.1 ...)
@@ -2069,7 +2069,7 @@ CVE-2026-102946 (joserfc is a Python library that provides an implementation of
 CVE-2026-102740 (The AsyncHttpClient library allows Java applications to execute HTTP r ...)
 	TODO: check
 CVE-2026-102631 (In authd before 0.7.1, the user identity matching in UpdateUser (inter ...)
-	TODO: check
+	NOT-FOR-US: Canonical authd
 CVE-2026-102527 (Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2 ...)
 	NOT-FOR-US: Nuxt OG Image
 CVE-2026-102477 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
@@ -3130,7 +3130,7 @@ CVE-2026-110607 (BizSpring Shop through commit cf22d39daaf1 contains a payment v
 CVE-2026-110606 (LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains  ...)
 	TODO: check
 CVE-2026-110605 (libschrift through 0.10.2 contains a divide by zero vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: libschrift
 CVE-2026-110604 (Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bound ...)
 	TODO: check
 CVE-2026-110603 (LASzip through 3.5.0 contains an invalid free vulnerability in laszip_ ...)
@@ -3141,9 +3141,9 @@ CVE-2026-110602 (libmspack through 0.11alpha contains an uninitialized pointer f
 CVE-2026-110601 (libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out- ...)
 	TODO: check
 CVE-2026-110600 (xlsxio through 0.2.37 contains a NULL pointer dereference vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: xlsxio
 CVE-2026-110599 (L-SMASH through 2.14.5 contains a double free vulnerability in hevc_se ...)
-	TODO: check
+	NOT-FOR-US: L-SMASH
 CVE-2026-110598 (Libyal libpff through 20260926 contains an integer underflow in libpff ...)
 	TODO: check
 CVE-2026-110597 (Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability ...)
@@ -3151,13 +3151,13 @@ CVE-2026-110597 (Tinyexr through 3.2.0 contains a heap out-of-bounds read vulner
 CVE-2026-110596 (quirc through 1.2 contains an excessive-iteration vulnerability in fin ...)
 	TODO: check
 CVE-2026-110595 (BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocati ...)
-	TODO: check
+	NOT-FOR-US: BottleCRM
 CVE-2026-110594 (BottleCRM 0.43 through 1.14.5 contains a regular expression denial of  ...)
-	TODO: check
+	NOT-FOR-US: BottleCRM
 CVE-2026-110593 (BottleCRM through 1.14.5 contains a server-side template injection vul ...)
-	TODO: check
+	NOT-FOR-US: BottleCRM
 CVE-2026-110592 (BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability ...)
-	TODO: check
+	NOT-FOR-US: BottleCRM
 CVE-2026-110591 (OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption v ...)
 	- asm <unfixed>
 	NOTE: https://gitlab.ow2.org/asm/asm/-/merge_requests/468



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d19241f70aeebec0cd485f48c9980e6781182e29

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d19241f70aeebec0cd485f48c9980e6781182e29
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/20f3d9d1/attachment.htm>
