[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sun Oct 18 20:14:32 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ca0a0780 by security tracker role at 2026-10-18T19:14:26+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,7 +1,7 @@
CVE-2026-96534 (The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87844 (The PickPlugins Product Designer for WooCommerce WordPress plugin thro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112063 (libstrophe through 0.14.0 contains a stack-based buffer overflow vulne ...)
TODO: check
CVE-2026-112062 (lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability ...)
@@ -47,9 +47,9 @@ CVE-2026-112019 (cgltf through 1.15 contains a heap out-of-bounds read vulnerabi
CVE-2026-112018 (cgltf through 1.15 contains a heap out-of-bounds write vulnerability i ...)
TODO: check
CVE-2026-112017 (JeecgBoot before 3.9.5 contains an sql injection vulnerability that al ...)
- TODO: check
+ NOT-FOR-US: JeecgBoot
CVE-2026-112016 (Netcore NR256CN through 1.5.140116 contains an unauthenticated file wr ...)
- TODO: check
+ NOT-FOR-US: Netcore
CVE-2026-112015 (Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability t ...)
TODO: check
CVE-2026-112014 (LobsterAI before 2026.10.16 contains a hardcoded password vulnerabilit ...)
@@ -133,91 +133,91 @@ CVE-2026-111866 (A weakness has been identified in nemoTyrant manong up to 7c9e5
CVE-2026-111865 (A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabd ...)
TODO: check
CVE-2026-111041 (The AI Engine WordPress plugin before 3.7.9 does not verify that the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110981 (The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not pr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110976 (The AI Engine WordPress plugin before 3.7.9 does not check that the i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110897 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110895 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110886 (Deserialization of Untrusted Data vulnerability in QuantumCloud Conver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110885 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110883 (Authentication Bypass by Primary Weakness vulnerability in VideoWhispe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110880 (Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110494 (Adding attachments to a release checked the repository and release of ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-110383 (Authorization Bypass Through User-Controlled Key vulnerability in WP E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110382 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110373 (Incorrect Privilege Assignment vulnerability in Hamid Alinia Login wit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110372 (Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoK ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110365 (Missing Authorization vulnerability in WPExperts Advanced File Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110324 (The visibility check of Gitea user profiles was applied to GET request ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-110311 (Creating a draft release through the API returned an `assets` list tha ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-110070 (The Modern Events Calendar Lite WordPress plugin before 7.36.4 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110069 (The Modern Events Calendar Lite WordPress plugin before 7.37.0 does no ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110035 (The Salon Booking System WordPress plugin before 10.31.11 does not re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110033 (The Salon Booking System WordPress plugin before 10.31.11 does not va ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110032 (The Salon Booking System WordPress plugin before 10.31.11 does not re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110031 (The Salon Booking System WordPress plugin before 10.31.11 does not pr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110026 (The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110024 (@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to ...)
TODO: check
CVE-2026-109937 (The Otter Blocks WordPress plugin before 3.2.3 does not validate that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109895 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109894 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109844 (`GET /api/v1/user/subscriptions` returned the metadata of every reposi ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-109553 (Gitea resolved the principals of an SSH certificate by searching the c ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-108485 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-108117
REJECTED
CVE-2026-107772
REJECTED
CVE-2026-107686 (The Gitea web handlers for adding and removing reactions on issues and ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-107618 (`POST /{owner}/{repo}/topics` was registered without the sign-in middl ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-107436 (Deserialization of Untrusted Data vulnerability in WP Chill Strong Tes ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107345
REJECTED
CVE-2026-107274
REJECTED
CVE-2026-105964 (The Gitea Actions artifact v4 (Twirp) handlers read the whole request ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-105661 (Requesting `/{username}/-/repositories` for an individual user instead ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-105391
REJECTED
CVE-2026-104627 (The Gitea OpenID association callback in the security settings accepte ...)
- TODO: check
+ NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2024-4457 (The Management Console fails to properly validate input related to the ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-78497 (JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a ...)
NOT-FOR-US: JQ::Lite Perl module
CVE-2026-98868 (In the Linux kernel, the following vulnerability has been resolved: d ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ca0a078005bc80e095a40583f43f5eaa1ae862b5
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ca0a078005bc80e095a40583f43f5eaa1ae862b5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261018/930e9327/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list