[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Oct 20 20:16:07 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
565bf7ea by security tracker role at 2026-10-20T19:15:54+00:00
automatic NOT-FOR-US entries update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,63 +3,63 @@ CVE-2026-9589 (Missing authorization in the configuration cascade operations of
 CVE-2026-97406 (XERJ Console API bearer tokens can bypass the passkey\u2011only authen ...)
 	TODO: check
 CVE-2026-97400 (In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic d ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-96582 (A HID report descriptor is a sequence of items, each declaring in its  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-96406 (A VideoStreaming interface reports the size of its whole class-specifi ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read past a  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to execute arb ...)
 	TODO: check
 CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the Module M ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-95109 (The Cortex-A7 MMU Modules port validates a caller-supplied buffer by t ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-95108 (One logical thread of a user-mode ThreadX module costs the Module Mana ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-95107 (A ThreadX module chooses `object_size` when it calls `txm_module_objec ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-94202 (The Module Manager's block-pool create dispatcher proved that two `ALI ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-94192 (A ThreadX module allocates the control blocks of its kernel objects fr ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-94024 (The Module Manager's object lookup validated one byte of a memory-prot ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-94023 (A ThreadX module reaches a kernel object's delete service through the  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-94018 (The Web add-on's HTTP server dereferences and releases an uninitialize ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-93475 (The X.509 parser in NetX Secure accepts an RSA public key of any size, ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3  ...)
 	TODO: check
 CVE-2026-93003 (The Web add-on's HTTP server searches the entire request packet for he ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure decrements the m ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92843 (A missing bounds check in the TLS 1.3 Certificate-message parser of Ne ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92539 (A service account with user-management permissions in one organization ...)
-	TODO: check
+	NOT-FOR-US: Grafana
 CVE-2026-92454 (The GUIX software JPEG decoder reads four kinds of marker segment with ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parq ...)
 	TODO: check
 CVE-2026-91189 (The GUIX binary resource loader never checks that a font page's glyph  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-91186 (The PNG chunk reader has no notion of chunk ordering. It records wheth ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-91059 (The GUIX JPEG software decoder enforces no ordering on JPEG markers. A ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-91057 (`_gx_multi_line_text_view_display_info_get()` reads one byte past the  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-91041 (Mounting an attacker-controlled FAT image with fault tolerance enabled ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-90800 (Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and bel ...)
 	TODO: check
 CVE-2026-90799 (Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and be ...)
@@ -139,17 +139,17 @@ CVE-2026-43835 (A vulnerability in the firmware upgrade functionality could allo
 CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs settings funct ...)
 	TODO: check
 CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulne ...)
-	TODO: check
+	NOT-FOR-US: Nokia
 CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local privilege escala ...)
-	TODO: check
+	NOT-FOR-US: Nokia
 CVE-2026-28331 (SolarWinds Patch Manager exposes sensitive information accessible to l ...)
-	TODO: check
+	NOT-FOR-US: SolarWinds
 CVE-2026-28330 (SolarWinds Observability Self-Hosted was found to be affected by a sto ...)
-	TODO: check
+	NOT-FOR-US: SolarWinds
 CVE-2026-28329 (SolarWinds Observability Self-Hosted was found to be affected by a Ser ...)
-	TODO: check
+	NOT-FOR-US: SolarWinds
 CVE-2026-28328 (SolarWinds Observability Self-Hosted was found to be affected by a bro ...)
-	TODO: check
+	NOT-FOR-US: SolarWinds
 CVE-2026-21356
 	REJECTED
 CVE-2026-21270
@@ -169,15 +169,15 @@ CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS e
 CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
 	TODO: check
 CVE-2026-113802 (Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS c ...)
-	TODO: check
+	NOT-FOR-US: Wavlink
 CVE-2026-113711 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
 	TODO: check
 CVE-2026-113710 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
 	TODO: check
 CVE-2026-113709 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
-	TODO: check
+	NOT-FOR-US: Argo CD
 CVE-2026-113708 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
-	TODO: check
+	NOT-FOR-US: Argo CD
 CVE-2026-113703 (SuggestArr before 3.0.0 contains an authentication bypass vulnerabilit ...)
 	TODO: check
 CVE-2026-113683 (VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a refle ...)
@@ -197,7 +197,7 @@ CVE-2026-113677 (Froxlor from 0.10.0 before 2.3.15 contains a missing authorizat
 CVE-2026-113676 (Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vul ...)
 	TODO: check
 CVE-2026-113672 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
-	TODO: check
+	NOT-FOR-US: Argo CD
 CVE-2026-113671 (ApostropheCMS is an open-source Node.js content management system. Fro ...)
 	TODO: check
 CVE-2026-113670 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
@@ -305,15 +305,15 @@ CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription Mana
 CVE-2026-113469 (A failure has been identified in the SNS during dynamic data files sig ...)
 	TODO: check
 CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming data wit ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-113466 (A security vulnerability has been detected in MinIO up to RELEASE.2025 ...)
 	TODO: check
 CVE-2026-113465 (It is possible to execute a DOM-based Cross-Site Scripting attack agai ...)
 	TODO: check
 CVE-2026-113459 (In versions running on TYPO3 10 and 11, the configured OpenAI API key  ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-113442 (Values entered by visitors were placed into the HTML summary email wit ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by ...)
 	TODO: check
 CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
@@ -439,21 +439,21 @@ CVE-2026-112909 (filelock is a platform-independent file lock for Python. Prior
 CVE-2026-112906 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
 	TODO: check
 CVE-2026-112861 (Authorization Bypass Through User-Controlled Key vulnerability in xnau ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112840 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112836 (Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112834 (Missing Authorization vulnerability in Castos Seriously Simple Podcast ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112833 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112829 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112824 (Missing Authorization vulnerability in Magepeople inc. Bus Ticket Book ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112823 (Missing Authorization vulnerability in WP User Manager WP User Manager ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112787 (OpenCATS before 0.10.0 contains a missing authorization vulnerability  ...)
 	TODO: check
 CVE-2026-112786 (OpenCATS before 0.10.0 contains a missing authorization vulnerability  ...)
@@ -465,35 +465,35 @@ CVE-2026-112784 (OpenCATS before 0.10.0 contains a missing authorization vulnera
 CVE-2026-112783 (OpenCATS before 0.10.0 contains a missing authorization vulnerability  ...)
 	TODO: check
 CVE-2026-112240 (The download link for files uploaded through a form relied on a token  ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112239 (The extension provides a backend endpoint that writes a submitted valu ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112238 (The file search of the extension builds its database conditions by wra ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112237 (The extension provides a public proxy endpoint that fetches a URL on b ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112177 (A flaw was found in Ghostscript as shipped with Red Hat Enterprise Lin ...)
 	TODO: check
 CVE-2026-112071 (The order cancellation function accepts an order identifier from the r ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112070 (The AJAX routes of the extension do not check whether a backend user h ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112069 (The extension no longer applied its access protection to files in file ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112068 (The backend module does not check whether a backend user has access to ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112067 (The extension hides the correct answer to each CAPTCHA inside the imag ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112066 (The JSON import of the cookie consent configuration did not respect th ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112065 (The routes that provide consent history and statistics data did not ch ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-112064 (The backend module for reviewing the consent history accepted sorting, ...)
-	TODO: check
+	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-111844 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111843 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111767 (MCP TypeScript SDK is the official TypeScript SDK for Model Context Pr ...)
 	TODO: check
 CVE-2026-111765 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
@@ -519,7 +519,7 @@ CVE-2026-110306 (fast-uri is a dependency-free RFC 3986 URI parser and serialize
 CVE-2026-110180 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
 	TODO: check
 CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box \u2013 WordPr ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system informati ...)
 	TODO: check
 CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive info ...)
@@ -529,11 +529,11 @@ CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of spec
 CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive enti ...)
 	TODO: check
 CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run synchronously o ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-107755 (Insufficient filtering of credentials in the _replicator database in A ...)
 	TODO: check
 CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers security co ...)
 	TODO: check
 CVE-2026-105941 (The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted  ...)
@@ -553,13 +553,13 @@ CVE-2026-101296 (A missing critical step in authentication vulnerability in Apac
 CVE-2026-101201 (A malformed header in the binary file fed to QBinaryJson::fromBinaryDa ...)
 	TODO: check
 CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: Adobe
 CVE-2026-100132 (Acrobat for Edge is affected by an out-of-bounds read vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: Adobe
 CVE-2025-71436 (Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-b ...)
 	TODO: check
 CVE-2024-2323 (The RemoteUserStoreManagerService does not sufficiently validate passw ...)
-	TODO: check
+	NOT-FOR-US: WSO2
 CVE-2026-71195
 	- manila <unfixed> (bug #1151439)
 	NOTE: https://security.openstack.org/ossa/OSSA-2026-046.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/565bf7ea80eab57b684acaf81f97bd1446f7676e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/565bf7ea80eab57b684acaf81f97bd1446f7676e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/3ec42020/attachment.htm>

More information about the debian-security-tracker-commits mailing list