[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 19 20:15:48 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4c445016 by security tracker role at 2026-10-19T19:15:39+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,97 +1,97 @@
CVE-2026-91858 (FopProducer transforms the incoming XSL-FO message body by creating a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-90910 (Missing authentication for critical function vulnerability in Apache A ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-8168 (Uncontrolled recursion in the SVG parser and renderer of the Qt SVG mo ...)
TODO: check
CVE-2026-88901 (Improper Restriction of XML External Entity Reference vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-88900 (Deserialization of Untrusted Data vulnerability in Apache Camel Camel- ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86589 (Incorrect implementation of authentication algorithm vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86375 (Dell Application Installer, versions prior to 26.09.0.1, contain a Mis ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-85317 (Use of Cache Containing Sensitive Information vulnerability in Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85316 (Insufficient Granularity of Access Control vulnerability in Apache Cam ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85315 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85314 (Improper Input Validation vulnerability in Apache Camel Mail component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85313 (Permissive Cross-domain Policy with Untrusted Domains vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85312 (Improper Input Validation vulnerability in Apache Camel Core component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85301 (Improper Authentication vulnerability in Apache Camel Keycloak compone ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85300 (Incorrect Default Permissions vulnerability in Apache Camel PQC compon ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85296 (Exposure of Data Element to Wrong Session vulnerability in Apache Came ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85260 (Insertion of Sensitive Information into Log File vulnerability in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85257 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85254 (Improper Handling of Case Sensitivity vulnerability in Apache Camel Pl ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85251 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85250 (Improper Restriction of XML External Entity Reference vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85249 (Improper Input Validation vulnerability in Apache Camel Tika component ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85248 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85247 (Improper Certificate Validation vulnerability in Apache Camel Knative ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85246 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85245 (Exposure of Data Element to Wrong Session vulnerability in Apache Came ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-85243 (Improper Validation of Integrity Check Value vulnerability in Apache C ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84181 (Improper Authentication vulnerability in Apache Camel Shiro component. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84180 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84178 (Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84176 (Permissive Cross-domain Policy with Untrusted Domains vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-83531 (Improper Control of Generation of Code ('Code Injection'), Improper Ne ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80344 (Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 c ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80343 (Improper Handling of Case Sensitivity vulnerability in Apache Camel Ne ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-80312 (Improper Authentication vulnerability in Apache Camel OAuth component. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79986 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79985 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79984 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79983 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79633 (vulnerability in Apache Answer. This issue affects Apache Answer: t ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79624 (Insufficient session expiration vulnerability in Apache Answer. Thi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79620 (Exposure of sensitive information through data queries vulnerability i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-79613 (vulnerability in Apache Answer. This issue affects Apache Answer: t ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78165 (Deserialization of Untrusted Data vulnerability in Apache Camel Spring ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78164 (Improper Neutralization of Special Elements Used in a Template Engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78163 (Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-78162 (Deserialization of Untrusted Data vulnerability in Apache Camel. Th ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77228
REJECTED
CVE-2026-77227
@@ -99,79 +99,79 @@ CVE-2026-77227
CVE-2026-77225
REJECTED
CVE-2026-76994 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71563 (Missing Authorization vulnerability in Apache Answer. This issue af ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71253 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
TODO: check
CVE-2026-6930 (IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-6719 (IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-68482 (Missing Authorization vulnerability in Apache Answer. This issue af ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-67249 (A vulnerability in Apache Answer. This issue affects Apache Answer: ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64945 (A vulnerability in Apache Answer. This issue affects Apache Answer: ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64944 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-64943 (Insertion of Sensitive Information into Log File vulnerability in Apac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-55644 (Element X iOS is a Matrix iOS Client provided by Element. Element X iO ...)
TODO: check
CVE-2026-4418 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML inject ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-4413 (IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. T ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-4405 (IBM Concert 1.0 through 3.0.0 allows web page cache to be stored local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3628 (IBM Concert 1.0 through 3.0.0 allows information disclosure through ex ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3303 (IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3295 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-3161 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cr ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-38671 (Cross Site Scripting vulnerability in Ellucian Banner Student Registra ...)
TODO: check
CVE-2026-1510 (IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-1501 (IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Va ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15661 (IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inje ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14511 (IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to ca ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13695 (SQL injection (SQLi) vulnerability\u2014specifically a UNION-based vul ...)
TODO: check
CVE-2026-12727 (IBM MQ could allow an authenticated attacker to cause potential proces ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12670 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12669 (IBM MQ could allow an authenticated attacker to trigger a minor out-of ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12665 (IBM MQ could allow a remote attacker to execute arbitrary code due to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12660 (IBM MQ Web Console could allow an authenticated administrator to write ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12350 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12343 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12254 (Netskope is notified about a potential gap in its agent (NSClient) whe ...)
- TODO: check
+ NOT-FOR-US: Netskope
CVE-2026-12155 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12148 (IBM MQ Operator could allow an authenticated attacker to cause a denia ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11831 (IBM MQ could allow an authenticated attacker to cause a limited denial ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11829 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11828 (IBM MQ could allow a remote attacker with queue manager control or man ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0 contains a pa ...)
TODO: check
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to b ...)
@@ -285,13 +285,13 @@ CVE-2026-112248 (A security vulnerability has been detected in grandnode grandno
CVE-2026-112247 (A weakness has been identified in Wuxi Wubang Security Software Five-i ...)
TODO: check
CVE-2026-112222 (Missing Authorization vulnerability in Surfer Surfer surferseo allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112214 (A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. Whe ...)
TODO: check
CVE-2026-112210 (A flaw was found in the rhc-canonical-facts.service systemd unit shipp ...)
TODO: check
CVE-2026-112199 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112195 (A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affect ...)
TODO: check
CVE-2026-112193 (A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacte ...)
@@ -317,7 +317,7 @@ CVE-2026-112161 (MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygU
CVE-2026-112159 (A security vulnerability has been detected in JumpServer up to 4.10.19 ...)
TODO: check
CVE-2026-112158 (A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/ ...)
- TODO: check
+ NOT-FOR-US: MikroTik
CVE-2026-112157 (A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1. ...)
TODO: check
CVE-2026-112153 (A vulnerability was detected in vraj404 Criminal-Management-System up ...)
@@ -333,7 +333,7 @@ CVE-2026-112149 (A vulnerability was identified in vraj404 Criminal-Management-S
CVE-2026-112147 (A vulnerability was found in ai-genius-automations octoally up to 1.0. ...)
TODO: check
CVE-2026-112146 (A vulnerability was detected in D-Link E15, M32, R15 and R32. This iss ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-112145 (A security vulnerability has been detected in speaches-ai speaches up ...)
TODO: check
CVE-2026-112144 (A weakness has been identified in satya-vinay Events-Management-System ...)
@@ -371,11 +371,11 @@ CVE-2026-112100 (A vulnerability was determined in DeepPavlov up to 1.7.0. This
CVE-2026-112098 (A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacte ...)
TODO: check
CVE-2026-112097 (A vulnerability was found in SourceCodester Inventory System 1.0. This ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112096 (A vulnerability has been found in SourceCodester Inventory System 1.0. ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112095 (A flaw has been found in SourceCodester Inventory System 1.0. This aff ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-112094 (A security vulnerability has been detected in michaelrsweet mxml 4.0.5 ...)
TODO: check
CVE-2026-112093 (A vulnerability has been found in subhajitkhan online-clinic-managemen ...)
@@ -387,11 +387,11 @@ CVE-2026-112091 (A flaw has been found in Dav-ee dairy-management-system 31ace96
CVE-2026-112090 (A vulnerability was detected in Dav-ee dairy-management-system 31ace96 ...)
TODO: check
CVE-2026-111939 (Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111938 (Frappe CRM before 1.74.0 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111937 (Frappe CRM before 1.81.2 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-111936 (Sigma File Manager through 2.2.0 contains a server-side request forger ...)
TODO: check
CVE-2026-111935 (NoteGen through 0.38.3 contains an external control of file path vulne ...)
@@ -405,19 +405,19 @@ CVE-2026-111899 (KitchenOwl through 0.7.10 contains a server-side request forger
CVE-2026-111883 (Locust through 2.46.7 contains a cross-site request forgery vulnerabil ...)
TODO: check
CVE-2026-111862 (Rank Math SEO PRO for WordPress is affected by a supply-chain compromi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111845 (Missing Authorization vulnerability in YITH YITH WooCommerce Product B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111839 (Missing Authorization vulnerability in VideoWhisper.com Broadcast Live ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111836 (Missing Authorization vulnerability in WP ManageNinja LLC FluentCommun ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111831 (Missing Authorization vulnerability in WP ManageNinja LLC FluentForm f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111829 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111828 (Improper Validation of Specified Quantity in Input vulnerability in Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111759 (markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typ ...)
TODO: check
CVE-2026-111757 (Hono is a Web application framework that provides support for any Java ...)
@@ -435,17 +435,17 @@ CVE-2026-111439 (\u5728 openGauss-server\u7684 src/common/backend/utils/adt/genf
CVE-2026-111438 (\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d ...)
TODO: check
CVE-2026-111414 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111410 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111408 (Deserialization of Untrusted Data vulnerability in ExpressTech Quiz An ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111407 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111406 (Unrestricted Upload of File with Dangerous Type vulnerability in PT No ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111398 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111066 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
TODO: check
CVE-2026-111065 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -471,23 +471,23 @@ CVE-2026-111046 (FOSSBilling is an open source billing and client-management pla
CVE-2026-111045 (CLI Bridge provides filesystem access within a workspace root. Prior t ...)
TODO: check
CVE-2026-110902 (Authorization Bypass Through User-Controlled Key vulnerability in Liqu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110898 (Incorrect Privilege Assignment vulnerability in WPDeveloper Essential ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110887 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110379 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110363 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110008 (@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versio ...)
TODO: check
CVE-2026-10743 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-10574 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-10572 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-109437 (Cognition before 0.13.0 contains an unauthenticated remote code execut ...)
TODO: check
CVE-2026-109434 (Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofin ...)
@@ -499,23 +499,23 @@ CVE-2026-109432 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contain
CVE-2026-109431 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a mis ...)
TODO: check
CVE-2026-108837 (Allocation of resources without limits or throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108833 (Default startup profile miss security settingsin Apache Kylin. Any dep ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108823 (Exposure of Sensitive Information to an Unauthorized Actor during job ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108780 (Potential JDBC source configuration validationvulnerability in Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108776 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108771 (Missing authentication for in-house broadcast andpolymorphic deseriali ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108766 (Missing authorization on jdbc source config update in Apache Kylin.Imp ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108764 (Server-Side request forgery (SSRF) vulnerability in Apache Kylin.Impac ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108762 (Path-confinement bypassduring metadata backup deletion in Apache Kylin ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107571 (Incorrect default permissions in the Windows installer of Progressive ...)
TODO: check
CVE-2026-107569 (Unchecked input for a loop condition in Progressive Robot hMailServer ...)
@@ -541,7 +541,7 @@ CVE-2026-107082 (Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allow
CVE-2026-107081 (SQL injection via identifier injection in the tableName and tableField ...)
TODO: check
CVE-2026-105810 (Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-104679 (VOCALOID6 Editor provided by Yamaha Corporation improperly restricts X ...)
TODO: check
CVE-2026-103314 (A flaw was found in Red Hat Advanced Cluster Security for Kubernetes ( ...)
@@ -549,11 +549,11 @@ CVE-2026-103314 (A flaw was found in Red Hat Advanced Cluster Security for Kuber
CVE-2026-103038 (PingTools Network Utilities 4.64 Free accepts an arbitrary value in th ...)
TODO: check
CVE-2025-7203 (The Management Console and product files expose sensitive data, includ ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-7043 (The ForgeRock client fails to correctly validate refresh tokens. This ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-6623 (The carbon console accepts user-supplied XML input without sufficientl ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-60482 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/ ...)
TODO: check
CVE-2025-60480 (A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function ...)
@@ -565,15 +565,15 @@ CVE-2025-55654 (A use-after-free in the gf_filter_pid_get_packet function (filte
CVE-2025-52290 (A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames f ...)
TODO: check
CVE-2025-13591 (The authentication endpoint of WSO2 Identity Server fails to provide a ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-13173 (Tokens associated with user sessions are not revoked when the correspo ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2025-10149 (The SCIM endpoint does not sufficiently validate authorization for fed ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-4412 (The software accepts user-supplied data without sufficient validation, ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2023-38375 (IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110688 (Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadrat ...)
- libcpanel-json-xs-perl <unfixed>
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44479935/
@@ -21653,7 +21653,7 @@ CVE-2026-25267 (Memory corruption when non-secure loader rewrites page tables be
CVE-2026-25263 (Memory corruption while processing IOCTL command called from user spac ...)
NOT-FOR-US: Qualcomm
CVE-2026-21589 (This is a vulnerability in Bitbucket Data Center, Confluence Data Cent ...)
- TODO: check
+ NOT-FOR-US: Atlassian
CVE-2026-105786 (Joplin is an open source note-taking and to-do application that organi ...)
- joplin <itp> (bug #931306)
CVE-2026-105785 (Joplin is an open source note-taking and to-do application that organi ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c445016974c744fd72ee1e56fe81c3eed41545a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c445016974c744fd72ee1e56fe81c3eed41545a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261019/3ac5f343/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list