[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 20 08:14:25 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
737332fe by security tracker role at 2026-10-20T07:14:15+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,97 +1,97 @@
CVE-2026-97627 (Hidden functionality issue exists in Multiple DVRs (Digital Video Reco ...)
TODO: check
CVE-2026-96903 (The Easy Property Listings WordPress plugin before 3.5.27 does not per ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96902 (The Easy Property Listings WordPress plugin before 3.5.28 does not res ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93878 (The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93300 (The EventON - Subscriber plugin for WordPress is vulnerable to generic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-8355 (IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a se ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-86981 (An out-of-bounds write issue was addressed with improved bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86979 (A privacy issue was addressed with improved checks. This issue is fixe ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86977 (An authorization issue was addressed with improved network restriction ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86976 (An authorization issue was addressed with improved state management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86975 (An out-of-bounds read was addressed with improved bounds checking. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86963 (A denial-of-service issue was addressed with improved input validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86962 (A double free issue was addressed with improved memory management. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86961 (A race condition was addressed with additional validation. This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86959 (An input validation issue was addressed with improved input validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86957 (An out-of-bounds read was addressed with improved bounds checking. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86955 (An authorization issue was addressed with improved state management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86953 (An out-of-bounds write issue was addressed with improved bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86949 (This issue was addressed by enforcing library validation on the affect ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86948 (This issue was addressed by enforcing library validation on the affect ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86944 (An out-of-bounds write issue was addressed with improved bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86940 (This issue was addressed by removing the vulnerable code. This issue i ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86935 (This issue was addressed by removing additional entitlements. This iss ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86933 (A permissions issue was addressed with additional sandbox restrictions ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86932 (An authorization issue was addressed with improved state management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86928 (A path handling issue was addressed with improved validation. This iss ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86922 (A type confusion issue was addressed with improved state management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86921 (A permissions issue was addressed with improved validation. This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86919 (A stack overflow was addressed with improved input validation. This is ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86918 (An out-of-bounds write issue was addressed with improved bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86915 (A race condition was addressed with improved locking. This issue is fi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86914 (An information disclosure issue was addressed with improved state mana ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86913 (A use after free issue was addressed with improved memory management. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86907 (An authorization issue was addressed with improved entitlement checks. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86875 (An input validation issue was addressed with improved input validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86874 (An out-of-bounds read was addressed with improved input validation. Th ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86872 (A logic issue was addressed with improved state management. This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86871 (An integer underflow was addressed with improved input validation. Thi ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86868 (An authentication issue was addressed with improved state management. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86467 (Apache Airflow Amazon provider: the AWS auth manager's SAML login flow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-84613 (An out-of-bounds write issue was addressed with improved bounds checki ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84582 (A privacy issue was addressed with improved access restrictions. This ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84579 (A logic issue was addressed with improved checks. This issue is fixed ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84547 (A memory corruption issue was addressed with improved input validation ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84508 (This issue was addressed with improved validation of the caller's acce ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-84490 (This issue was addressed through improved state management. This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-82166 (Dell Application Store, versions prior to 26.05.0.7, contain a Missing ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-77938 (Letta through 0.16.8 contains an information disclosure vulnerability ...)
TODO: check
CVE-2026-77937 (Letta through 0.16.8 contains an authentication bypass vulnerability t ...)
@@ -111,27 +111,27 @@ CVE-2026-77930 (EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vuln
CVE-2026-77926 (Aix-DB 1.2.4 contains a remote code execution vulnerability that allow ...)
TODO: check
CVE-2026-77684 (The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/h ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-76788 (The OSDP Control Panel reply parser cp_decode_response() in subsys/mgm ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-76787 (The UpdateHub firmware-over-the-air client parses the CoAP probe respo ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-75753 (Missing Authentication for a Critical Function in certain ASUS routers ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75128 (Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endp ...)
TODO: check
CVE-2026-71170 (Dell Application Store, versions prior to 26.05.0.7, contains an Uncon ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-71169 (Dell Application Store, versions prior to 26.05.0.7, contain an Incorr ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-65396 (A buffer overflow was addressed with improved size validation. This is ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65379 (The issue was addressed with improved handling of secure input state. ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65372 (A race condition was addressed with additional validation. This issue ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-65356 (An access issue was addressed with improved access controls. This issu ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-57529
REJECTED
CVE-2026-57528
@@ -151,21 +151,21 @@ CVE-2026-57512
CVE-2026-56714
REJECTED
CVE-2026-53995 (MLflow 3.17.1 and earlier contains a path traversal vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-28854 (The issue was addressed with additional app bundle integrity checks. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-28853 (The issue was addressed with improved checks. This issue is fixed in m ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-28850 (An authorization issue was addressed with improved state management. T ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-19595 (The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19178 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remo ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17518 (Buffer Copy without Checking Size of Input in certain ASUS router mode ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-12489 (An incorrect authorization vulnerability in the Data Access Layer (DAL ...)
- TODO: check
+ NOT-FOR-US: Zyxel
CVE-2026-113404 (WebITR developed by Uniong has a Insecure Deserialization vulnerabilit ...)
TODO: check
CVE-2026-113402 (ArmorX Spam developed by ArmorX Global Technology has a Local File Inc ...)
@@ -207,25 +207,25 @@ CVE-2026-112779 (Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a
CVE-2026-112778 (Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace va ...)
TODO: check
CVE-2026-112777 (Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112776 (Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112775 (Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass v ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112774 (Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112773 (Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112772 (Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vu ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112771 (Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112770 (Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote co ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-112769 (Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not en ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-112768 (Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates c ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-112406 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow ca ...)
TODO: check
CVE-2026-112405 (Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's ...)
@@ -269,7 +269,7 @@ CVE-2026-112371 (A vulnerability was determined in H3C Magic NX15 NX15V100R017.
CVE-2026-112370 (A vulnerability was found in H3C Magic NX15 100R017. This issue affect ...)
TODO: check
CVE-2026-112361 (A vulnerability has been found in Dolibarr up to 23.0.2. The impacted ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-112360 (A security vulnerability has been detected in Netis EAP930 1.250905.11 ...)
TODO: check
CVE-2026-112358 (A weakness has been identified in TiBillet Lespass up to 10e87909c5d52 ...)
@@ -315,17 +315,17 @@ CVE-2026-109440 (LangAlpha through 2026.09.07 contains an indirect prompt inject
CVE-2026-109395 (Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access ...)
TODO: check
CVE-2026-109126 (IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107400 (IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a rem ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107366 (IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-105815 (TP-Link Tapo C210 V3.60 may expose shared credential material and cryp ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105814 (TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105453 (IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and6.4.0. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-105299 (Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-p ...)
TODO: check
CVE-2026-105298 (Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whos ...)
@@ -333,15 +333,15 @@ CVE-2026-105298 (Summary Before version 0.9.0, Pingora accepted HTTP/2 reques
CVE-2026-105297 (Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 c ...)
TODO: check
CVE-2026-102438 (An uncontrolled search path element vulnerability in ASUS Armoury Crat ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-100737 (Hidden functionality issue exists in Multiple DVRs (Digital Video Reco ...)
TODO: check
CVE-2025-36252 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Li ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-36069 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-36061 (IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Ta ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2024-54657
REJECTED
CVE-2024-54656
@@ -711,7 +711,7 @@ CVE-2026-76994 (Exposure of Sensitive Information to an Unauthorized Actor vulne
CVE-2026-71563 (Missing Authorization vulnerability in Apache Answer. This issue af ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71253 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-6930 (IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic ...)
NOT-FOR-US: IBM
CVE-2026-6719 (IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/737332fe14990b675a672f82e7f204ca4c66dac6
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/737332fe14990b675a672f82e7f204ca4c66dac6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/6af450bf/attachment.htm>
More information about the debian-security-tracker-commits
mailing list