[Git][security-tracker-team/security-tracker][master] Process more NFUs

Sun Oct 18 06:42:13 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ffce469f by Salvatore Bonaccorso at 2026-10-18T07:41:53+02:00
Process more NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -118,9 +118,9 @@ CVE-2026-109701 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-100316 (The European VAT Compliance Assistant for WooCommerce plugin for WordP ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-71435 (Coder before 2.23.0 contains a session expiration bypass vulnerability ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2024-58398 (Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.1 ...)
-	TODO: check
+	NOT-FOR-US: Coder
 CVE-2026-110929
 	- openssh <not-affected> (Only affects non-Linux builds)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2553039
@@ -2679,7 +2679,7 @@ CVE-2026-101302 (TLS 1.3 embeds the actual record type as the last non-zero byte
 CVE-2026-100232 (Post-authentication Improper Neutralization of Special Elements used i ...)
 	NOT-FOR-US: SonicWall
 CVE-2026-0993 (SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer ove ...)
-	TODO: check
+	NOT-FOR-US: SODOLA SL902-SWTGW124AS firmware
 CVE-2026-0321 (Denial of service vulnerabilities in Palo Alto Networks PAN-OS\xae sof ...)
 	NOT-FOR-US: Palo Alto Networks
 CVE-2026-0320 (A command injection vulnerability in Palo Alto Networks PAN-OS\xae sof ...)
@@ -3914,7 +3914,7 @@ CVE-2026-101019 (Description NGINX JavaScript (njs) has a vulnerability where th
 CVE-2026-100413 (SeaweedFS is a distributed storage system for files and blobs. From 4. ...)
 	- seaweedfs <itp> (bug #956957)
 CVE-2026-100406 (dbt enables data analysts and engineers to transform their data using  ...)
-	TODO: check
+	NOT-FOR-US: dbt
 CVE-2026-100404 (Zulip is an open-source team collaboration tool. In Zulip Server versi ...)
 	- zulip-server <itp> (bug #800052)
 CVE-2026-100394 (Nezha Monitoring is a self-hostable, lightweight, servers and websites ...)
@@ -3930,7 +3930,7 @@ CVE-2026-100229 (A flaw was found in GStreamer's H.266 codec parser library (lib
 	- gst-plugins-bad1.0 <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2541471
 CVE-2026-100169 (Improper Authentication in the social account linking path of the Prow ...)
-	TODO: check
+	NOT-FOR-US: Prowler
 CVE-2026-100163 (The Appointment Booking Plugin \u2013 LatePoint | Calendar & Schedulin ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-0322 (A remote code execution (RCE) vulnerability in the management interfac ...)
@@ -3940,13 +3940,13 @@ CVE-2025-9373 (The PeproDev Branches Map plugin for WordPress is vulnerable to S
 CVE-2025-71433 (Kaneo before 2.1.6 contains a missing authorization vulnerability that ...)
 	NOT-FOR-US: Kaneo
 CVE-2024-58392 (PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: PhysicsFS
 CVE-2020-37282 (office-converter through 1.0.2 contains an OS command injection vulner ...)
 	NOT-FOR-US: office-converter
 CVE-2020-37281 (Gravitee API Management through 4.12.22 contains an authentication byp ...)
 	NOT-FOR-US: Gravitee
 CVE-2017-20286 (DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalet ...)
-	TODO: check
+	NOT-FOR-US: DevIL
 CVE-2016-20099 (L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_ ...)
 	NOT-FOR-US: L-SMASH
 CVE-2016-15060 (A vulnerability was found in PCMan FTP Server up to 2.0.7. This affect ...)
@@ -10170,15 +10170,15 @@ CVE-2023-54406 (Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox
 CVE-2022-51020 (Flower before 2.2.0 contains a cross-site request forgery vulnerabilit ...)
 	NOT-FOR-US: Flower
 CVE-2021-48012 (fast-toml through 0.5.4 contains a prototype pollution vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: fast-toml
 CVE-2021-48011 (Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability tha ...)
-	TODO: check
+	NOT-FOR-US: Servor
 CVE-2021-48009
 	REJECTED
 CVE-2020-37280 (cbor-sync through 1.0.4 contains a resource exhaustion vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: cbor-sync
 CVE-2020-37279 (easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vu ...)
-	TODO: check
+	NOT-FOR-US: easy-pdf-merge
 CVE-2026-103658 (GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a ...)
 	- aspell <unfixed> (bug #1150801)
 	[trixie] - aspell <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffce469f5d0667c8ea169f836c3ab92f36ba1b10

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffce469f5d0667c8ea169f836c3ab92f36ba1b10
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261018/6f6c0c44/attachment.htm>
