[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Oct 19 22:46:33 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
37a2b872 by Moritz Mühlenhoff at 2026-10-19T23:46:01+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -257,7 +257,7 @@ CVE-2026-11828 (IBM MQ could allow a remote attacker with queue manager control
CVE-2026-11319 (TickTick Android application (com.ticktick.task) 8.2.2.0 contains a pa ...)
NOT-FOR-US: TickTick Android application (com.ticktick.task)
CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to b ...)
- TODO: check
+ NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic of the M ...)
- php-mongodb <unfixed>
NOTE: https://jira.mongodb.org/browse/PHPC-276
@@ -286,7 +286,7 @@ CVE-2026-112306 (NocoBase @nocobase/plugin-collection-sql through 2.2.28 contain
CVE-2026-112305 (Semaphore UI through 2.19.16 contains a remote code execution vulnerab ...)
NOT-FOR-US: Semaphore UI
CVE-2026-112304 (docTR through 1.1.0 contains an unsafe deserialization vulnerability i ...)
- TODO: check
+ NOT-FOR-US: docTR
CVE-2026-112303 (GDevelop desktop app through 5.6.284 contains a credential leak vulner ...)
NOT-FOR-US: GDevelop
CVE-2026-112296 (FlyCms through commit edfdf724 contains a default credentials vulnerab ...)
@@ -402,61 +402,61 @@ CVE-2026-112178 (MISP contains an access control flaw in the proposal (shadow at
CVE-2026-112161 (MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64. ...)
NOT-FOR-US: MobaXterm
CVE-2026-112159 (A security vulnerability has been detected in JumpServer up to 4.10.19 ...)
- TODO: check
+ NOT-FOR-US: JumpServer
CVE-2026-112158 (A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/ ...)
NOT-FOR-US: MikroTik
CVE-2026-112157 (A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1. ...)
- TODO: check
+ NOT-FOR-US: memmy-agent
CVE-2026-112153 (A vulnerability was detected in vraj404 Criminal-Management-System up ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112152 (A security vulnerability has been detected in vraj404 Criminal-Managem ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112151 (A weakness has been identified in vraj404 Criminal Management System u ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112150 (A security flaw has been discovered in vraj404 Criminal-Management-Sys ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112149 (A vulnerability was identified in vraj404 Criminal-Management-System u ...)
- TODO: check
+ NOT-FOR-US: Criminal-Management-System
CVE-2026-112147 (A vulnerability was found in ai-genius-automations octoally up to 1.0. ...)
- TODO: check
+ NOT-FOR-US: ai-genius-automations
CVE-2026-112146 (A vulnerability was detected in D-Link E15, M32, R15 and R32. This iss ...)
NOT-FOR-US: D-Link
CVE-2026-112145 (A security vulnerability has been detected in speaches-ai speaches up ...)
- TODO: check
+ NOT-FOR-US: speaches-ai
CVE-2026-112144 (A weakness has been identified in satya-vinay Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112143 (A security flaw has been discovered in satya-vinay Events-Management-S ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112142 (A vulnerability was identified in satya-vinay Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112141 (A vulnerability was determined in satya-vinay Events-Management-System ...)
- TODO: check
+ NOT-FOR-US: Events-Management-System
CVE-2026-112140 (A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c8 ...)
- TODO: check
+ NOT-FOR-US: llSourcell Doctor-Dignity
CVE-2026-112139 (A vulnerability has been found in subhajitkhan online-clinic-managemen ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management
CVE-2026-112138 (A flaw has been found in diem-project diem up to 5.1.3. The impacted e ...)
- TODO: check
+ NOT-FOR-US: diem-project diem
CVE-2026-112108 (A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This i ...)
- TODO: check
+ NOT-FOR-US: fastllm
CVE-2026-112107 (A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this ...)
- TODO: check
+ NOT-FOR-US: fastllm
CVE-2026-112106 (A security vulnerability has been detected in TufayelLUS TikTok-Video- ...)
- TODO: check
+ NOT-FOR-US: TikTok-Video-Decoder-PHP
CVE-2026-112105 (A vulnerability has been found in GlitterWare Passy up to 1.10.1. The ...)
- TODO: check
+ NOT-FOR-US: GlitterWare Passy
CVE-2026-112104 (A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The ...)
- TODO: check
+ NOT-FOR-US: bandcamp-player
CVE-2026-112103 (A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. ...)
- TODO: check
+ NOT-FOR-US: fatfree-core
CVE-2026-112102 (A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts ...)
- TODO: check
+ NOT-FOR-US: NLP.js
CVE-2026-112101 (A vulnerability was determined in BlackBeltTechnology pi-agent-dashboa ...)
- TODO: check
+ NOT-FOR-US: pi-agent-dashboard
CVE-2026-112100 (A vulnerability was determined in DeepPavlov up to 1.7.0. This affects ...)
- TODO: check
+ NOT-FOR-US: DeepPavlov
CVE-2026-112098 (A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacte ...)
- TODO: check
+ NOT-FOR-US: DeepPavlov
CVE-2026-112097 (A vulnerability was found in SourceCodester Inventory System 1.0. This ...)
NOT-FOR-US: SourceCodester
CVE-2026-112096 (A vulnerability has been found in SourceCodester Inventory System 1.0. ...)
@@ -466,13 +466,13 @@ CVE-2026-112095 (A flaw has been found in SourceCodester Inventory System 1.0. T
CVE-2026-112094 (A security vulnerability has been detected in michaelrsweet mxml 4.0.5 ...)
TODO: check
CVE-2026-112093 (A vulnerability has been found in subhajitkhan online-clinic-managemen ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management-system
CVE-2026-112092 (A flaw has been found in subhajitkhan online-clinic-management-system ...)
- TODO: check
+ NOT-FOR-US: online-clinic-management-system
CVE-2026-112091 (A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e ...)
- TODO: check
+ NOT-FOR-US: dairy-management-system
CVE-2026-112090 (A vulnerability was detected in Dav-ee dairy-management-system 31ace96 ...)
- TODO: check
+ NOT-FOR-US: dairy-management-system
CVE-2026-111939 (Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnera ...)
NOT-FOR-US: Frappe
CVE-2026-111938 (Frappe CRM before 1.74.0 contains a missing authorization vulnerabilit ...)
@@ -480,17 +480,17 @@ CVE-2026-111938 (Frappe CRM before 1.74.0 contains a missing authorization vulne
CVE-2026-111937 (Frappe CRM before 1.81.2 contains a missing authorization vulnerabilit ...)
NOT-FOR-US: Frappe
CVE-2026-111936 (Sigma File Manager through 2.2.0 contains a server-side request forger ...)
- TODO: check
+ NOT-FOR-US: Sigma File Manager
CVE-2026-111935 (NoteGen through 0.38.3 contains an external control of file path vulne ...)
- TODO: check
+ NOT-FOR-US: NoteGen
CVE-2026-111925 (Mopidy before 4.0.5 contains a path traversal vulnerability that allow ...)
TODO: check
CVE-2026-111915 (Yank Note before 3.93.1 contains a path traversal vulnerability that a ...)
- TODO: check
+ NOT-FOR-US: Yank Note
CVE-2026-111899 (KitchenOwl through 0.7.10 contains a server-side request forgery vulne ...)
- TODO: check
+ NOT-FOR-US: KitchenOwl
CVE-2026-111883 (Locust through 2.46.7 contains a cross-site request forgery vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Locust
CVE-2026-111862 (Rank Math SEO PRO for WordPress is affected by a supply-chain compromi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-111845 (Missing Authorization vulnerability in YITH YITH WooCommerce Product B ...)
@@ -508,7 +508,7 @@ CVE-2026-111828 (Improper Validation of Specified Quantity in Input vulnerabilit
CVE-2026-111759 (markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typ ...)
TODO: check
CVE-2026-111757 (Hono is a Web application framework that provides support for any Java ...)
- TODO: check
+ NOT-FOR-US: Hono
CVE-2026-111755 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
TODO: check
CVE-2026-111750 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -518,9 +518,9 @@ CVE-2026-111749 (AIOHTTP is an asynchronous HTTP client/server framework for asy
CVE-2026-111748 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
TODO: check
CVE-2026-111439 (\u5728 openGauss-server\u7684 src/common/backend/utils/adt/genfile.cpp ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111438 (\u5728 openGauss-server \u7684 src/common/backend/libpq/hba.cpp \u4e2d ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111414 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111410 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -544,19 +544,19 @@ CVE-2026-111063 (AIOHTTP is an asynchronous HTTP client/server framework for asy
CVE-2026-111061 (russh is a Rust SSH client and server library that includes an SSH age ...)
TODO: check
CVE-2026-111059 (Mercury is a Python framework for sharing Jupyter notebooks as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111058 (Mercury is a Python framework for sharing Jupyter notebooks as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111057 (Mercury is a Python framework for sharing Jupyter notebooks as web app ...)
- TODO: check
+ NOT-FOR-US: Mercury
CVE-2026-111056 (FOSSBilling is an open source billing and client-management platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111053 (FOSSBilling is an open source billing and client-management platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111046 (FOSSBilling is an open source billing and client-management platform. ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-111045 (CLI Bridge provides filesystem access within a workspace root. Prior t ...)
- TODO: check
+ NOT-FOR-US: CLI Bridge
CVE-2026-110902 (Authorization Bypass Through User-Controlled Key vulnerability in Liqu ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110898 (Incorrect Privilege Assignment vulnerability in WPDeveloper Essential ...)
@@ -568,7 +568,7 @@ CVE-2026-110379 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-110363 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110008 (@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versio ...)
- TODO: check
+ NOT-FOR-US: @fastify/oauth2
CVE-2026-10743 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
NOT-FOR-US: IBM
CVE-2026-10574 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
@@ -576,15 +576,15 @@ CVE-2026-10574 (IBM MQ could allow an authenticated attacker to cause a denial o
CVE-2026-10572 (IBM MQ could allow an authenticated attacker to cause a denial of serv ...)
NOT-FOR-US: IBM
CVE-2026-109437 (Cognition before 0.13.0 contains an unauthenticated remote code execut ...)
- TODO: check
+ NOT-FOR-US: Cognition
CVE-2026-109434 (Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofin ...)
- TODO: check
+ NOT-FOR-US: Fenrir Sleipnir Browser
CVE-2026-109433 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an au ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-109432 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an ex ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-109431 (Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a mis ...)
- TODO: check
+ NOT-FOR-US: Camunda
CVE-2026-108837 (Allocation of resources without limits or throttling vulnerability in ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108833 (Default startup profile miss security settingsin Apache Kylin. Any dep ...)
@@ -604,37 +604,37 @@ CVE-2026-108764 (Server-Side request forgery (SSRF) vulnerability in Apache Kyli
CVE-2026-108762 (Path-confinement bypassduring metadata backup deletion in Apache Kylin ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107571 (Incorrect default permissions in the Windows installer of Progressive ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107569 (Unchecked input for a loop condition in Progressive Robot hMailServer ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107568 (Missing authorization in the Sieve notify action (6.2.22 through 6.3.6 ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107567 (Use of a less trusted source in the DKIM signing of Progressive Robot ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107566 (Missing authorization in the Sieve editheader action (6.2.22 through 6 ...)
- TODO: check
+ NOT-FOR-US: Progressive Robot
CVE-2026-107188 (A user can upload export reports with any file contents and specify an ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107187 (A user can access any database details, such as usernames and password ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107186 (An unauthenticated user can send a DWR request with isPasswordUppercas ...)
- TODO: check
+ NOT-FOR-US: Eptura Archibus
CVE-2026-107084 (Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107083 (SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107082 (Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an au ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-107081 (SQL injection via identifier injection in the tableName and tableField ...)
- TODO: check
+ NOT-FOR-US: Senayan Library Management Systems
CVE-2026-105810 (Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow ...)
NOT-FOR-US: TPLink
CVE-2026-104679 (VOCALOID6 Editor provided by Yamaha Corporation improperly restricts X ...)
- TODO: check
+ NOT-FOR-US: VOCALOID6
CVE-2026-103314 (A flaw was found in Red Hat Advanced Cluster Security for Kubernetes ( ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-103038 (PingTools Network Utilities 4.64 Free accepts an arbitrary value in th ...)
- TODO: check
+ NOT-FOR-US: PingTools Network Utilities
CVE-2025-7203 (The Management Console and product files expose sensitive data, includ ...)
NOT-FOR-US: WSO2
CVE-2025-7043 (The ForgeRock client fails to correctly validate refresh tokens. This ...)
@@ -642,13 +642,13 @@ CVE-2025-7043 (The ForgeRock client fails to correctly validate refresh tokens.
CVE-2025-6623 (The carbon console accepts user-supplied XML input without sufficientl ...)
NOT-FOR-US: WSO2
CVE-2025-60482 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/ ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60480 (A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function ...)
- TODO: check
+ - gpac <removed>
CVE-2025-55667 (A segmentation violation in the dump_isom_saps function (/mp4box/filed ...)
- TODO: check
+ - gpac <removed>
CVE-2025-55654 (A use-after-free in the gf_filter_pid_get_packet function (filter_core ...)
- TODO: check
+ - gpac <removed>
CVE-2025-52290 (A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames f ...)
TODO: check
CVE-2025-13591 (The authentication endpoint of WSO2 Identity Server fails to provide a ...)
@@ -758,9 +758,9 @@ CVE-2026-74922 (The Document Gallery WordPress plugin through 5.1.1 does not ver
CVE-2026-74921 (The Document Gallery WordPress plugin through 5.1.1 does not sanitise ...)
NOT-FOR-US: WordPress plugin
CVE-2026-16487 (A flaw was found in bootc when operating with the default containers s ...)
- TODO: check
+ NOT-FOR-US: bootc
CVE-2026-16460 (A flaw was found in bootc and ostree. Already-staged deployments are f ...)
- TODO: check
+ NOT-FOR-US: bootc
CVE-2026-112112 (An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing ...)
- bird3 <unfixed>
- bird2 <unfixed>
@@ -844,9 +844,9 @@ CVE-2026-112026 (A security vulnerability has been detected in light0011 cms c77
CVE-2026-112025 (A weakness has been identified in light0011 cms c774dce31c6df0055568a8 ...)
NOT-FOR-US: light0011 cms
CVE-2026-111441 (\u5728 openGauss-server \u7684 src/gausskernel/cbb/utils/hll/hll.cpp \ ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-111440 (\u5728 openGauss-connector-jdbc \u7684 pgjdbc/src/main/java/org/postgr ...)
- TODO: check
+ NOT-FOR-US: openGauss-server
CVE-2026-110034 (The Salon Booking System WordPress plugin before 10.31.11 does not enf ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108984 (A vulnerability is in Web Server default connection ports under the pr ...)
@@ -870,9 +870,9 @@ CVE-2026-106010 (The BDM Digital Payment Gateway WordPress plugin through 1.3.12
CVE-2026-103311 (The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103091 (Missing Authorization (CWE-862) and Initialization of a Resource with ...)
- TODO: check
+ NOT-FOR-US: Google SAM
CVE-2026-102503 (Missing Authentication for Critical Function (CWE-306) and Missing Aut ...)
- TODO: check
+ NOT-FOR-US: Google SAM
CVE-2026-110336
- libplack-perl 1.0055-1 (unimportant; bug #1151241)
NOTE: Fixed by: https://github.com/plack/Plack/commit/92eba54ba698b4dad9009604064c9f9fe40e01eb (1.0055)
@@ -1079,7 +1079,7 @@ CVE-2026-110031 (The Salon Booking System WordPress plugin before 10.31.11 does
CVE-2026-110026 (The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correc ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110024 (@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to ...)
- TODO: check
+ NOT-FOR-US: @fastify/jwt
CVE-2026-109937 (The Otter Blocks WordPress plugin before 3.2.3 does not validate that ...)
NOT-FOR-US: WordPress plugin
CVE-2026-109895 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/37a2b872effa66cd30618a23d0b1d288450c86ff
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/37a2b872effa66cd30618a23d0b1d288450c86ff
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261019/d5797e11/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list