[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 17 16:19:28 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
29a748ee by Salvatore Bonaccorso at 2026-10-17T17:19:01+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -137,11 +137,11 @@ CVE-2026-108743 (Improper Neutralization of Special Elements used in an OS Comma
CVE-2026-108709 (Authentication bypass within in-house network in Apache Kylin.Impact m ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108374 (ERPNext is a free and open source Enterprise Resource Planning tool. P ...)
- TODO: check
+ NOT-FOR-US: ERPNext
CVE-2026-108373 (ERPNext is a free and open source Enterprise Resource Planning tool. P ...)
- TODO: check
+ NOT-FOR-US: ERPNext
CVE-2026-108372 (Open and provider-neutral, LoopX is a lightweight state kernel and loc ...)
- TODO: check
+ NOT-FOR-US: LoopX
CVE-2026-108123 (The WP Booking System \u2013 Booking Calendar plugin for WordPress is ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107763 (The Fastcache by Host.it plugin for WordPress is vulnerable to authori ...)
@@ -780,7 +780,7 @@ CVE-2026-107621 (JPEGParser can enter an infinite loop while parsing a specially
CVE-2026-107617 (An attacker can use a hard-coded credential to log in to EseeCloud dev ...)
NOT-FOR-US: EseeCloud
CVE-2026-107564 (An unauthenticated remote attacker may use an allocation of resources ...)
- TODO: check
+ NOT-FOR-US: gocsaf Development Community csaf_provider
CVE-2026-106705 (ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vul ...)
NOT-FOR-US: ELADMIN
CVE-2026-106030 (NordVPN for Windows allows local attackers to stop unprotected Windows ...)
@@ -1960,7 +1960,7 @@ CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions 4.0.0
- node-undici 8.12.2+dfsg+~cs3.2.3-1
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
CVE-2026-109131 (The Hub collection module documentation renderer in the unified Ansibl ...)
- TODO: check
+ NOT-FOR-US: Red Hat Ansible Automation Platform
CVE-2026-108499 (Missing Authorization vulnerability in WebberZone Knowledge Base knowl ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108498 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -1970,7 +1970,7 @@ CVE-2026-108497 (Improper Neutralization of Special Elements used in an SQL Comm
CVE-2026-108491 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108334 (A flaw was found in the internal WebAssembly (WASM) shim used by the K ...)
- TODO: check
+ NOT-FOR-US: Kuadrant operator
CVE-2026-108175 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108116 (In Progress Kendo UI for jQuery prior to v2026.3.1015, specially craft ...)
@@ -2022,7 +2022,7 @@ CVE-2026-106147 (In Progress\xae Kendo\xae UI for jQuery releases starting with
CVE-2026-105882 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105660 (Improper Validation of Syntactic Correctness of Input vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-105474 (A server-side template injection exists in SolusVM 2 up to version 2.0 ...)
NOT-FOR-US: SolusVM
CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION contains ...)
@@ -2030,28 +2030,28 @@ CVE-2026-105271 ("\u30b2\u30aa\u30a2\u30d7\u30ea" provided by GEO CORPORATION co
CVE-2026-105065 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-104828 (HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, H ...)
- TODO: check
+ NOT-FOR-US: HtmlUnit Neko
CVE-2026-104827 (react/http is an event-driven, streaming HTTP client and server implem ...)
- TODO: check
+ NOT-FOR-US: react/http
CVE-2026-104618 (On request the `sdbootutil` script creates a world-readable debug log ...)
- TODO: check
+ NOT-FOR-US: openSUSE sdbootutil package
CVE-2026-104617 (There are two invocations of `qrencode` to display a QR code for scann ...)
- TODO: check
+ NOT-FOR-US: openSUSE sdbootutil package
CVE-2026-104586 (AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Comm ...)
- TODO: check
+ NOT-FOR-US: AUTOM8N (WHM/cPanel plugin)
CVE-2026-104266 (tinytag is a Python library for reading audio file metadata. From 2.0. ...)
- python-tinytag 2.3.0-1
NOTE: https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg
NOTE: https://github.com/tinytag/tinytag/pull/326
NOTE: https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e (2.3.0)
CVE-2026-104150 (AdonisJS HTTP Server is a package for handling HTTP requests in the Ad ...)
- TODO: check
+ NOT-FOR-US: AdonisJS
CVE-2026-104025 (Path Traversal (CWE-22) in the execute_obj function of the archive obj ...)
TODO: check
CVE-2026-104024 (Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extens ...)
TODO: check
CVE-2026-103936 (libp2p is a JavaScript implementation of the libp2p networking stack. ...)
- TODO: check
+ NOT-FOR-US: Node libp2p
CVE-2026-103509 (P4 Search (formerly Helix Search) returns stored credentials in cleart ...)
NOT-FOR-US: Perforce
CVE-2026-103508 (P4 Search (formerly Helix Search) allows an authenticated user holding ...)
@@ -2460,7 +2460,7 @@ CVE-2026-110668 (A weakness has been identified in cemtan sar2html 4.0.0. Affect
CVE-2026-110310 (A remote user who can read encrypted objects in the S3 bucket can forc ...)
NOT-FOR-US: Amazon
CVE-2026-109430 (Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entit ...)
- TODO: check
+ NOT-FOR-US: Ellucian WebAdvisor
CVE-2026-109145 (The User Rights Access Manager WordPress plugin through 1.1.3 does not ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108587 (The 10Web Booster \u2013 Website speed optimization, Cache & Page Spee ...)
@@ -3238,7 +3238,7 @@ CVE-2026-109527 (The Model Context Protocol Python SDK is the official Python SD
CVE-2026-109506 (Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-an ...)
NOT-FOR-US: TPLink
CVE-2026-109439 (Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8. ...)
- TODO: check
+ NOT-FOR-US: Lantronix
CVE-2026-109438 (3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an ...)
TODO: check
CVE-2026-108484 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -3248,21 +3248,21 @@ CVE-2026-108483 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-108480 (Missing Authorization vulnerability in Skydropx Skydropx skydropx allo ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108395 (The Model Context Protocol Java SDK is the official Java SDK for Model ...)
- TODO: check
+ NOT-FOR-US: Model Context Protocol Java SDK
CVE-2026-108390 (Hestia Control Panel is a lightweight and powerful control panel for t ...)
- TODO: check
+ NOT-FOR-US: Hestia Control Panel
CVE-2026-108291 (Deserialization of Untrusted Data vulnerability in itthinx Affiliates ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108151 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108072 (Vulnerability due to incorrect permissions in TSplus Remote Access sha ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108071 (Incorrect authentication vulnerability in the TSplus Remote Access mul ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108070 (A vulnerability involving improper access control in the TSplus Remote ...)
- TODO: check
+ NOT-FOR-US: TSplus Remote Access
CVE-2026-108065 (SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval. ...)
- TODO: check
+ NOT-FOR-US: Channel Software WebAlliance eCommerce
CVE-2026-107913
REJECTED
CVE-2026-107870 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -3300,9 +3300,9 @@ CVE-2026-107421 (Session Fixation vulnerability in VideoWhisper.com Broadcast Li
CVE-2026-107417 (Missing Authorization vulnerability in Muralidharan Ramasamy Push Noti ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-107381 (svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::pr ...)
- TODO: check
+ NOT-FOR-US: darylldoyle svg-sanitizer
CVE-2026-107171 (An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent ...)
- TODO: check
+ NOT-FOR-US: Trellix
CVE-2026-106599 (Deserialization of Untrusted Data vulnerability in Brainstorm Force Su ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-106465 (The NetX Secure DTLS server sends a HelloVerifyRequest carrying a fres ...)
@@ -3312,7 +3312,7 @@ CVE-2026-106464 (`_nx_secure_x509_parse_signature_data` computes the certificate
CVE-2026-105874 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105659 (Uncontrolled Resource Consumption vulnerability in mtrudel bandit allo ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-105236 (Improper Certificate Validation vulnerability in the ssl application i ...)
TODO: check
CVE-2026-105107 (Koha is vulnerable to SQL injection in the Most-circulated items repor ...)
@@ -3342,7 +3342,7 @@ CVE-2026-104142 (DataEase is an open source data visualization and analysis tool
CVE-2026-104141 (DataEase is an open source data visualization and analysis tool. Authe ...)
NOT-FOR-US: DataEase
CVE-2026-104103 (Ludwig is a low-code framework for building custom LLMs, neural networ ...)
- TODO: check
+ NOT-FOR-US: Ludwig
CVE-2026-104086 (7-Zip before 26.03 contains an uninitialized memory disclosure vulnera ...)
TODO: check
CVE-2026-103994 (A Heap-based Buffer Overflow vulnerability in theVXLAN Gateway Daemon( ...)
@@ -3350,23 +3350,23 @@ CVE-2026-103994 (A Heap-based Buffer Overflow vulnerability in theVXLAN Gateway
CVE-2026-103993 (An Out-of-bounds Write vulnerability in the routing protocol daemon (r ...)
NOT-FOR-US: Juniper
CVE-2026-103975 (Appium is a cross-platform automation framework for all kinds of apps, ...)
- TODO: check
+ NOT-FOR-US: Appium
CVE-2026-103974 (lichess.org is the forever free, adless and open source chess server. ...)
- TODO: check
+ NOT-FOR-US: Lichess Lila
CVE-2026-103946 (An SQL injection vulnerability could allow an authenticated user to re ...)
NOT-FOR-US: Tenable
CVE-2026-103930 (cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until ...)
TODO: check
CVE-2026-103929 (mise manages dev tools like node, python, cmake, and terraform. Prior ...)
- TODO: check
+ NOT-FOR-US: mise
CVE-2026-103907 (The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to un ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103905 (The authentication middleware of the JTL-Shop administration backend p ...)
- TODO: check
+ NOT-FOR-US: JTL-Shop
CVE-2026-103904 (The public consent endpoint of JTL-Shop accepts arbitrary consent name ...)
- TODO: check
+ NOT-FOR-US: JTL-Shop
CVE-2026-103671 (External control of assumed-Immutable web parameter issue exists in EC ...)
- TODO: check
+ NOT-FOR-US: EC-CUBE
CVE-2026-103415 (When a TLS 1.3 client processes a HelloRetryRequest, it copies the ser ...)
NOT-FOR-US: Eclipse
CVE-2026-103414 (The GUIX binary resource (theme) loader sizes its arena and populates ...)
@@ -8505,7 +8505,7 @@ CVE-2026-109152 (A security vulnerability has been detected in jbardin scp.py up
NOTE: https://github.com/jbardin/scp.py/issues/206
NOTE: https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d (v0.16.2)
CVE-2026-109149 (A weakness has been identified in beautifier js-beautify up to 1.15.1/ ...)
- TODO: check
+ NOT-FOR-US: Node js-beautify
CVE-2026-109144 (A vulnerability was identified in wbond certvalidator up to 0.11.1. Th ...)
TODO: check
CVE-2026-109143 (A vulnerability was determined in calcom cal.com and cal.diy up to 6.2 ...)
@@ -8603,7 +8603,7 @@ CVE-2026-106171 (A improper neutralization of special elements used in an os com
CVE-2026-106170 (An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortine ...)
NOT-FOR-US: Fortinet
CVE-2026-106108 (Quasar Framework is a framework for building high-performance Vue.js u ...)
- TODO: check
+ NOT-FOR-US: Quasar Framework
CVE-2026-106047 (A Path Traversal vulnerability in the template export functionality of ...)
NOT-FOR-US: Ivanti
CVE-2026-106043 (A Missing Authentication for Critical Function vulnerability in Ivanti ...)
@@ -8621,7 +8621,7 @@ CVE-2026-105460 (A flaw was found in BlueZ. An out-of-bounds read vulnerability
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545923
NOTE: https://github.com/bluez/bluez/issues/2687
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker Hub's accoun ...)
- TODO: check
+ NOT-FOR-US: Docker Hub'saccount-to-organization conversion feature
CVE-2026-104937 (Shopware version 6.7 allows the upload of attacker\u2011controlled HTM ...)
NOT-FOR-US: Shopware
CVE-2026-104935 (Authentication bypass by spoofing in ICS before version 25.1.3.0 allow ...)
@@ -8666,7 +8666,7 @@ CVE-2026-103965 (An issue in MongoDB Server's aggregation framework can cause ce
CVE-2026-103937 (Misskey is an open source, federated social media platform. From 13.0. ...)
NOT-FOR-US: Misskey
CVE-2026-103928 (Metabase is an open source business intelligence and analytics platfor ...)
- TODO: check
+ NOT-FOR-US: Metabase
CVE-2026-103857 (Adobe Framemaker is affected by an out-of-bounds read vulnerability th ...)
NOT-FOR-US: Adobe
CVE-2026-103856 (Adobe Framemaker is affected by an out-of-bounds read vulnerability th ...)
@@ -8684,7 +8684,7 @@ CVE-2026-103417 (Firefox for iOS could autofill saved credentials into a new pag
CVE-2026-103076 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Reg ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103030 (Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2 ...)
- TODO: check
+ NOT-FOR-US: Dio
CVE-2026-103028 (SFTPGo is an open source, event-driven file transfer solution. From 2. ...)
- sftpgo <itp> (bug #1050829)
CVE-2026-102989 (TanStack Router is a client-first, server-capable, fully type-safe rou ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29a748eedcc833d4e8a48196a89af83dbbe53d72
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/29a748eedcc833d4e8a48196a89af83dbbe53d72
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/fd7e599a/attachment.htm>
More information about the debian-security-tracker-commits
mailing list