[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Oct 17 20:30:54 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ccd2e73e by Salvatore Bonaccorso at 2026-10-17T21:30:33+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,45 +1,45 @@
 CVE-2026-111934 (Coder before 2.34.7 contains an IP spoofing vulnerability in the Extra ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111933 (Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and  ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111932 (Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and  ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111931 (Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111930 (Coder from 2.26.0 before 2.34.8 contains an incorrect authorization fl ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111929 (Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulne ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111928 (Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vul ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111927 (Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111926 (Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTT ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-111924 (Fleet before 4.83.0 contains a denial of service vulnerability that al ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-111923 (Fleet before 4.89.0 contains an unbounded recursion vulnerability in A ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-111922 (Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configurati ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111921 (Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulner ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111920 (Vikunja 2.6.0 contains a broken access control flaw in getProjectAcces ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111919 (Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vul ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111918 (Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111917 (Vikunja 2.3.0 before 2.7.0 contains an improper session validation vul ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-111916 (Admidio before 5.0.16 contains an information disclosure vulnerability ...)
-	TODO: check
+	NOT-FOR-US: Admidio
 CVE-2026-111914 (Admidio from 5.0.11 before 5.0.16 contains a broken access control vul ...)
-	TODO: check
+	NOT-FOR-US: Admidio
 CVE-2026-111913 (Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: Admidio
 CVE-2026-111912 (Admidio from 5.0.0 before 5.0.16 contains an insecure direct object re ...)
-	TODO: check
+	NOT-FOR-US: Admidio
 CVE-2026-111911 (phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerab ...)
 	NOT-FOR-US: phpMyFAQ
 CVE-2026-111910 (phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an au ...)
@@ -288,7 +288,7 @@ CVE-2026-103899 (The EU VAT Assistant for WooCommerce plugin for WordPress is vu
 CVE-2026-103376 (The PeachPay \u2014 Payments & Express Checkout for WooCommerce (suppo ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-102834 (JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedi ...)
-	TODO: check
+	NOT-FOR-US: JavaCV
 CVE-2026-102608 (ZoneMinder is a free, open source closed-circuit television software a ...)
 	TODO: check
 CVE-2026-102607 (ZoneMinder is a free, open source closed-circuit television software a ...)
@@ -2231,17 +2231,17 @@ CVE-2026-101311 (The framebuffer device model's maximum resolution constants wer
 CVE-2026-101310 (The HDA audio device model did not check for zero-length Buffer Descri ...)
 	NOT-FOR-US: FreeBSD
 CVE-2026-101309 (The xHCI (USB 3) device model did not validate or save the event ring  ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101308 (When an audio channel's buffer needs to be resized, the sound(4) drive ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101307 (When the PCM sample array needs to grow, the RACK stack doubles a 16-b ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101303 (The IPv6 UDP send path for unconnected sockets did not apply the jail  ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101290 (A remote attacker may send a specially crafted network packet that cau ...)
 	NOT-FOR-US: SICK AG
 CVE-2026-101287 (Authentication bypass vulnerability in Stela, versions prior to 1.60.1 ...)
-	TODO: check
+	NOT-FOR-US: Stela
 CVE-2026-100409 (OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0. ...)
 	NOT-FOR-US: Next.js
 CVE-2026-100354 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149 ...)
@@ -2646,13 +2646,13 @@ CVE-2026-102980 (Plane is an open-source project management tool. Prior to 1.4.0
 CVE-2026-102298 (In Omada Controller MSP mode, the user-confirmation endpoint fails to  ...)
 	NOT-FOR-US: TPLink
 CVE-2026-101306 (SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101305 (renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory argume ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101304 (When fdescfs(4) was mounted in a jail with the "nodup" option, opening ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero byte of the ...)
-	TODO: check
+	NOT-FOR-US: FreeBSD
 CVE-2026-100232 (Post-authentication Improper Neutralization of Special Elements used i ...)
 	NOT-FOR-US: SonicWall
 CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer ove ...)
@@ -3536,7 +3536,7 @@ CVE-2026-102944 (cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0
 	NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv
 	NOTE: Fixed by: https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585 (v0.51.0)
 CVE-2026-102899 (Sentry is an application monitoring and error tracking platform. From  ...)
-	TODO: check
+	NOT-FOR-US: Sentry
 CVE-2026-102893 (Zulip is an open-source team collaboration tool. In Zulip Server versi ...)
 	TODO: check
 CVE-2026-102756 (DataEase is an open source data visualization and analysis tool. Prior ...)
@@ -3544,11 +3544,11 @@ CVE-2026-102756 (DataEase is an open source data visualization and analysis tool
 CVE-2026-102755 (DataEase is an open source data visualization and analysis tool. Prior ...)
 	NOT-FOR-US: DataEase
 CVE-2026-102748 (Dgraph is an open source distributed GraphQL database. Prior to 25.4.0 ...)
-	TODO: check
+	NOT-FOR-US: Dgraph
 CVE-2026-102695 (OmniFaces is a utility library for Faces. In OmniFaces versions before ...)
-	TODO: check
+	NOT-FOR-US: OmniFaces
 CVE-2026-102682 (Pipecat is an open-source Python framework for building real-time voic ...)
-	TODO: check
+	NOT-FOR-US: Pipecat
 CVE-2026-102479 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0,  ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-102476 (In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0,  ...)
@@ -3558,7 +3558,7 @@ CVE-2026-102471 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or
 CVE-2026-102460 (In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0 ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-102354 (BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In ...)
-	TODO: check
+	NOT-FOR-US: BentoPDF
 CVE-2026-102185 (A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability ...)
 	NOT-FOR-US: Juniper
 CVE-2026-102184 (AnImproper Validation of Specified Quantity in Input vulnerability in  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ccd2e73ef44d95d93701b54d0d67676be6691810

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ccd2e73ef44d95d93701b54d0d67676be6691810
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/9a46f452/attachment.htm>

More information about the debian-security-tracker-commits mailing list