[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 22 08:19:34 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d9fb6af9 by security tracker role at 2026-10-22T07:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-97328 (The WebP Express WordPress plugin before 0.25.16 does not escape value ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96778 (Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJp ...)
TODO: check
CVE-2026-96644 (Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PI ...)
@@ -21,77 +21,77 @@ CVE-2026-96637 (Pillow is a Python imaging library. Prior to 13.0.0, SpiderImage
CVE-2026-96636 (Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek ...)
TODO: check
CVE-2026-96398 (Incorrect Authorization vulnerability in Drupal Webform allows Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96392 (Improper Neutralization of Special Elements Used in a Template Engine ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96391 (Missing Authorization vulnerability in Drupal Webform REST allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96390 (Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96388 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Li ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96387 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96386 (Missing Authorization vulnerability in Drupal Smart Content allows For ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96385 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96384 (Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96382 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96380 (Missing Authorization vulnerability in Drupal CSS Usage Analyzer allow ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96379 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96378 (Improperly Controlled Modification of Dynamically-Determined Object At ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96377 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96376 (Improper Neutralization of Special Elements used in an OS Command ("OS ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96375 (Improper Certificate Validation vulnerability in Drupal Cloud allows A ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96374 (Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Brow ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96373 (Incorrect Authorization vulnerability in Drupal Webform allows Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96372 (Insufficient Granularity of Access Control vulnerability in Drupal Web ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96371 (Privilege Defined With Unsafe Actions vulnerability in Drupal Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96370 (Incorrect Authorization vulnerability in Drupal Webform allows Server ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96369 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96368 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96367 (Privilege Defined With Unsafe Actions vulnerability in Drupal Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96366 (Incorrect Authorization vulnerability in Drupal Webform allows Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96365 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96364 (Improper Control of Interaction Frequency vulnerability in Drupal Webf ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96363 (Privilege Defined With Unsafe Actions vulnerability in Drupal Webform ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96362 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96361 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96360 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96359 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96358 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96357 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96356 (Incorrect Authorization vulnerability in Drupal Webform allows Forcefu ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-96355 (Improper Neutralization of Special Elements Used in a Template Engine ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-92210 (NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vul ...)
TODO: check
CVE-2026-92209 (NoMachine Redis Improper Authentication Local Privilege Escalation Vul ...)
@@ -117,57 +117,57 @@ CVE-2026-91403 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
CVE-2026-90484 (The MySQL client response parser in Apache bRPC dereferences a null po ...)
TODO: check
CVE-2026-89052 (A hardcoded cryptographic key management vulnerability exists in Arche ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-89035 (MikroTik RouterOS through 7.24.5 contains a session token replay vulne ...)
- TODO: check
+ NOT-FOR-US: MikroTik
CVE-2026-88849 (The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87955 (Missing Authorization vulnerability in Drupal Ultimate Table Field all ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87954 (Missing Authorization vulnerability in Drupal Taxonomy Term Glossary a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87953 (Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87952 (Authentication Bypass by Capture-replay vulnerability in Drupal SAML S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87951 (Insecure Storage of Sensitive Information vulnerability in Drupal SAML ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87950 (Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Servi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87949 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87948 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87947 (Improper Verification of Cryptographic Signature vulnerability in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87946 (Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Servi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87945 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in D ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87944 (Improper Certificate Validation vulnerability in Drupal SAML SSO - Ser ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87943 (Missing Authorization vulnerability in Drupal SAML SSO - Service Provi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87942 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87941 (Vulnerability in Drupal Patreon. This issue affects Patreon versions: ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87940 (Use of Web Browser Cache Containing Sensitive Information vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87939 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87938 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87937 (URL Redirection to Untrusted Site ('Open Redirect') vulnerability in D ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87936 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-87849 (The Discovery naming-service reply parser in Apache bRPC (versions < 1 ...)
TODO: check
CVE-2026-87096 (Sensitive information disclosure and manipulation due to improper auth ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2026-87095 (Sensitive information disclosure and manipulation due to improper auth ...)
- TODO: check
+ NOT-FOR-US: Acronis
CVE-2026-86249 (On a brpc::Server that sets both ServerOptions.auth and ServerOptions. ...)
TODO: check
CVE-2026-86147 (External control of file name or path and uncontrolled resource consum ...)
@@ -175,37 +175,37 @@ CVE-2026-86147 (External control of file name or path and uncontrolled resource
CVE-2026-86146 (Inconsistent interpretation of HTTP requests (HTTP request/response sm ...)
TODO: check
CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any capabili ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source DataStream (SD ...)
TODO: check
CVE-2026-84924 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84923 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84921 (Missing Authorization vulnerability in Drupal Webform Submissions Dele ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84920 (Incorrect Authorization vulnerability in Drupal Unpublished Node Permi ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84919 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84918 (Improper Verification of Cryptographic Signature vulnerability in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84917 (Incorrect Authorization vulnerability in Drupal Jsonapi Role Access a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84916 (Missing Authorization vulnerability in Drupal Islandora allows Forcef ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84915 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84914 (Missing Authorization vulnerability in Drupal Calculate Working Days a ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84913 (Missing Authorization vulnerability in Drupal AI Translate allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84912 (Missing Authorization vulnerability in Drupal AI (Artificial Intellige ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84911 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84910 (Missing Authorization vulnerability in Drupal Advanced Search allows F ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-84748 (Improper authorization in Apache bRPC (versions < 1.18.0) on all platf ...)
TODO: check
CVE-2026-84747 (Interpretation conflict in the HTTP protocol implementation in Apache ...)
@@ -229,25 +229,25 @@ CVE-2026-82210 (Enforceable assertion in the streaming feature of Apache bRPC (v
CVE-2026-81755 (Uncontrolled resource consumption in the streaming RPC component of Ap ...)
TODO: check
CVE-2026-81163 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-80463 (Unbounded memory accumulation in the stream message reassembly path of ...)
TODO: check
CVE-2026-79976 (The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpi ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79704 (An out-of-bounds read vulnerability exists in the streaming RPC client ...)
TODO: check
CVE-2026-78392 (The Link Library WordPress plugin before 7.9.6 does not sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78334 (Missing authentication in the streaming RPC path of Apache bRPC (versi ...)
TODO: check
CVE-2026-78119 (The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) reques ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78118 (The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the h ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78117 (The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infi ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78116 (The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-78066 (Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms ...)
TODO: check
CVE-2026-78058 (Uncontrolled resource consumption in the HTTP/2 (h2) receive path of A ...)
@@ -269,7 +269,7 @@ CVE-2026-76526 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76524 (A vulnerability in the control channel socket implementation of O ...)
TODO: check
CVE-2026-76505 (A vulnerability in the IPv4 packet processing functionality of Cisco I ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76497 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76496 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -289,7 +289,7 @@ CVE-2026-76490 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76489 (Multiple Cisco products are affected by a vulnerability in the memory ...)
TODO: check
CVE-2026-76487 (A vulnerability in Cisco Unified Communications Manager (Unified CM) a ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76481 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76479 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -319,19 +319,19 @@ CVE-2026-76408 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76407 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76406 (In Splunk SOAR versions below 8.7.0, an unauthenticated user with acce ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76308 (In Splunk SOAR versions below 8.7.0, an authenticated user could chang ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76307 (In Splunk SOAR versions below 8.7.0, a user that holds a role with the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76306 (In Splunk SOAR versions below 8.7.0, a user that has the "Observer" ro ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76305 (In Splunk SOAR versions below 8.7.0, an authenticated user who does no ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76304 (In Splunk SOAR versions below 8.7.0, an authenticated user who does no ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76303 (In Splunk SOAR versions below 8.7.0, a user that holds a role with the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76302 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76301 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -341,29 +341,29 @@ CVE-2026-76300 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76299 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76298 (In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76297 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76296 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76295 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76294 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76293 (In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76292 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76291 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76290 (In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an un ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76289 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76288 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76287 (In Splunk Enterprise versions below 10.4.4, a user that holds a role w ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-74758 (A heap use-after-free in the RTMP protocol component of Apache bRPC (v ...)
TODO: check
CVE-2026-74757 (Uncontrolled resource allocation in the mcpack2pb component in Apache ...)
@@ -381,11 +381,11 @@ CVE-2026-61916 (Out-of-bounds reads in URL parsing and case-insensitive header l
CVE-2026-61902 (Apache bRPC versions before 1.18.0 do not consistently enforce the con ...)
TODO: check
CVE-2026-59562 (Missing authentication for critical function vulnerability in Apache I ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-59229 (The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a ha ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-58663 (An authentication bypass vulnerability exists in Apache IoTDB's Thrift ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-58064 (The Redis protocol implementation in Apache bRPC allowed inline comman ...)
TODO: check
CVE-2026-56388 (The Redis server command parser in Apache bRPC accepts an empty RESP a ...)
@@ -429,27 +429,27 @@ CVE-2026-20019 (Multiple Cisco products are affected by a vulnerability in the S
CVE-2026-20011 (Multiple Cisco products are affected by a vulnerability in the Snort 3 ...)
TODO: check
CVE-2026-19947 (The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c e ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-19676 (The user-mode verifier for the peci_transfer() system call, z_vrfy_pec ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-18748 (The Bluetooth Classic A2DP host stores a codec Information Element (IE ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17557 (A flaw was found in the `lm-evaluation-harness` component of Red Hat O ...)
TODO: check
CVE-2026-16648 (Insertion of Sensitive Information into Log File vulnerability in Drup ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-16255 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-15723 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-14556 (The HappyForms WordPress plugin before 1.26.15 does not sanitise or es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14288 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-13319 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-12664 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-114732 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
TODO: check
CVE-2026-114731 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
@@ -489,7 +489,7 @@ CVE-2026-114715 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affec
CVE-2026-114714 (Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by ...)
TODO: check
CVE-2026-114664 (Frappe Framework before 16.33.0 contains a blind SQL injection vulnera ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-114663 (Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omi ...)
TODO: check
CVE-2026-114662 (Obot before 0.26.0 contains an authentication bypass vulnerability in ...)
@@ -523,19 +523,19 @@ CVE-2026-114636 (Traefik v3.7.13 before v3.7.14 contains an access-control bypas
CVE-2026-114635 (Traefik before v2.11.58 and v3.7.14 contains an authentication bypass ...)
TODO: check
CVE-2026-114634 (WWBN AVideo before 29.4.0 contains a blind server-side request forgery ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-114633 (WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerab ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-114577 (A vulnerability was found in oretnom23 php-travel-agency-system. This ...)
TODO: check
CVE-2026-114576 (A vulnerability has been found in Linksys RE6250 1.0.04.001. This affe ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-114575 (A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affec ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114574 (A security vulnerability has been detected in massCodeIO massCode 5.10 ...)
TODO: check
CVE-2026-114570 (WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114509 (Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, ...)
TODO: check
CVE-2026-114508 (Laravel is a web application framework. From 12.45.0 until 12.68.0 and ...)
@@ -595,7 +595,7 @@ CVE-2026-114438 (A flaw was found in the Update User Locale required action of t
CVE-2026-114437 (In the Golang Chi web framework, the ClientIPFromXFF middleware skips ...)
TODO: check
CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site scripting vulne ...)
- TODO: check
+ NOT-FOR-US: e107 CMS
CVE-2026-114406 (The system certificate authority (CA) store in Red Hat products, distr ...)
TODO: check
CVE-2026-114405 (Improper validation of array index vulnerability in Velneo vServer.Thi ...)
@@ -629,29 +629,29 @@ CVE-2026-114392 (Trudesk through 1.2.11 contains an authorization bypass vulnera
CVE-2026-114391 (ZenTao PMS before 22.3 contains an authorization bypass vulnerability ...)
TODO: check
CVE-2026-114390 (Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing au ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114389 (Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing au ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114388 (Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 co ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-114387 (Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulne ...)
TODO: check
CVE-2026-114386 (Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_ca ...)
TODO: check
CVE-2026-114384 (A security vulnerability has been detected in itsourcecode Online Cake ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114383 (A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This imp ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114382 (A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. Thi ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-114381 (A vulnerability was determined in itsourcecode Online Cake Ordering Sy ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114380 (A vulnerability was found in itsourcecode Online Cake Ordering System ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114379 (A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vul ...)
TODO: check
CVE-2026-114378 (A vulnerability was detected in itsourcecode Online Cake Ordering Syst ...)
- TODO: check
+ NOT-FOR-US: itsourcecode System
CVE-2026-114377 (A security vulnerability has been detected in leomoon-studios wiki-go ...)
TODO: check
CVE-2026-114376 (A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. ...)
@@ -667,17 +667,17 @@ CVE-2026-114362 (A flaw has been found in HarnessRouter up to 0.31.12. This impa
CVE-2026-114361 (A vulnerability was detected in HarnessRouter up to 0.31.10. This affe ...)
TODO: check
CVE-2026-114268 (A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-114267 (A vulnerability was detected in SourceCodester Food Order Management S ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-114266 (A security vulnerability has been detected in ProjectWorlds Advanced L ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114265 (A weakness has been identified in ProjectWorlds Advanced Library Manag ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114264 (A security flaw has been discovered in ProjectWorlds Advanced Library ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114263 (A vulnerability was identified in ProjectWorlds Advanced Library Manag ...)
- TODO: check
+ NOT-FOR-US: Project Worlds
CVE-2026-114262 (A vulnerability was determined in file-management-system dc9ce1bf27f94 ...)
TODO: check
CVE-2026-114261 (A vulnerability was found in MomoTommy file-management-system dc9ce1bf ...)
@@ -727,17 +727,17 @@ CVE-2026-114220 (NT OneAPP developed by NewType Infortech has an Improper Certif
CVE-2026-114219 (NT OneAPP developed by NewType Infortech has a Hard-coded Credentials ...)
TODO: check
CVE-2026-114184 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114182 (Missing Authorization vulnerability in IdeaBox Creations PowerPack Add ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114180 (Missing Authorization vulnerability in Wpmet Metform metform allows Ex ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114177 (Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114176 (Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114175 (Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114145 (GitPython is a python library used to interact with Git repositories. ...)
TODO: check
CVE-2026-114144 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
@@ -821,101 +821,101 @@ CVE-2026-113787 (odf-kit allows users to generate, fill, read, and convert OpenD
CVE-2026-113786 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
TODO: check
CVE-2026-113779 (The pfSense REST API package is an unofficial, open-source REST and Gr ...)
- TODO: check
+ NOT-FOR-US: pfSense
CVE-2026-113461 (Local privilege escalation in Checkmk 2.5.0p14 allows a local user wit ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-112868 (Authorization Bypass Through User-Controlled Key vulnerability in H5P ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112867 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112843 (Missing Authorization vulnerability in WP Chill Strong Testimonials st ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112826 (Missing Authorization vulnerability in eLightUp Falcon \u2013 WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112408 (Missing verification of source of a communication channel in the defau ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-112378 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-112326 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-112221 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112212 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-111972 (The Photo Engine (Media Organizer & Lightroom) WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111971 (The Photo Engine (Media Organizer & Lightroom) WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111958 (The Royal MCP WordPress plugin before 1.5.7 does not limit a preview- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111852 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111849 (Missing Authorization vulnerability in Magepeople inc. WpTravelly tour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111848 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111847 (Missing Authorization vulnerability in Kings Plugins MarketKing market ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111840 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111838 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111837 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111835 (Missing Authorization vulnerability in bjorntech BjornTech Swish for W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111834 (Unrestricted Upload of File with Dangerous Type vulnerability in Kitae ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111833 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111832 (Unrestricted Upload of File with Dangerous Type vulnerability in WP Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111401 (Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tail ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111184 (NoMachine Named Pipe Incorrect Permission Assignment Local Privilege E ...)
TODO: check
CVE-2026-111183 (GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution ...)
TODO: check
CVE-2026-111075 (In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fa ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-111074 (In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-110938 (In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vu ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-110899 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110884 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110803 (VaadinService.requestEnd() in Vaadin Framework 8 locks the session and ...)
TODO: check
CVE-2026-110744 (A flaw was found in multicluster-global-hub-operator-bundle. The opera ...)
TODO: check
CVE-2026-110370 (Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110369 (Deserialization of Untrusted Data vulnerability in GS Plugins WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110354 (HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cau ...)
TODO: check
CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to c ...)
TODO: check
CVE-2026-110264 (An issue has been discovered in GitLab CE/EE affecting all versions fr ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-110011 (The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110010 (The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109987 (The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro W ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109931 (The Infility Global WordPress plugin before 2.16.25 does not perform a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109927 (The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107588 (Vaadin Charts renders charts with the Highcharts library and pins an e ...)
TODO: check
CVE-2026-107447 (The Contest Gallery WordPress plugin before 34.0.1 does not reliably v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107435 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106053
REJECTED
CVE-2026-105945 (The Pulsar Packages Management Service can be configured to store pack ...)
@@ -951,13 +951,13 @@ CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn t
CVE-2026-105869 (Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a clie ...)
TODO: check
CVE-2026-105777 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-105711 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-105270 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-105256 (The LatePoint WordPress plugin before 5.7.5 does not validate the clie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104949 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are a ...)
TODO: check
CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are a ...)
@@ -965,27 +965,27 @@ CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.
CVE-2026-104947 (WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing author ...)
TODO: check
CVE-2026-104642 (The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104641 (The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103634 (Out-of-bounds read and write in the Count-Min sketch deserialization o ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-103515 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-103301 (The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103234 (The WP Ultimate Review WordPress plugin before 2.4.5 does not neutrali ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103090 (Missing Authentication for Critical Function (CWE-306) and Insufficien ...)
TODO: check
CVE-2026-102536
REJECTED
CVE-2026-101138 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin before 4.1.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100420 (A sensitive information disclosure vulnerability in the cloud-client d ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-100142 (The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-71438 (An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in ...)
TODO: check
CVE-2025-60497 (A segmentation violation in the GetESD function (/isomedia/track.c) of ...)
@@ -1011,17 +1011,17 @@ CVE-2025-60476 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list function
CVE-2025-60469 (A NULL pointer dereference in the gf_ac4_presentation_ch_mode function ...)
TODO: check
CVE-2025-0326 (The system fails to invalidate existing access tokens associated with ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-7478 (When a WSO2 product is configured to use an external user store, the s ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-6423 (The product failed to enforce validation constraints on user-supplied ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-5563 (Due to an incomplete implementation, reCaptcha is not applied to certa ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-5139 (The Authentication Endpoint accepts user-supplied input without suffic ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-4989 (The callback URL parameter in WSO2 API Manager fails to validate user- ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-102486 (Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 ...)
- ntpsec <unfixed>
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
@@ -2140,9 +2140,9 @@ CVE-2026-87422 (Vulnerability in the Oracle Solaris product of Oracle Systems (c
CVE-2026-87421 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
NOT-FOR-US: Oracle
CVE-2026-87420 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87419 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87418 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87417 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
@@ -2168,7 +2168,7 @@ CVE-2026-87408 (Vulnerability in the Oracle Applications Framework product of Or
CVE-2026-87407 (Vulnerability in the Oracle Applications Framework product of Oracle E ...)
NOT-FOR-US: Oracle
CVE-2026-87404 (Vulnerability in the Pasta product of Oracle E-Business Suite (compone ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87403 (Vulnerability in the Applications DBA product of Oracle E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-87402 (Vulnerability in the Applications DBA product of Oracle E-Business Sui ...)
@@ -2238,7 +2238,7 @@ CVE-2026-87371 (Vulnerability in the Oracle WebCenter Content product of Oracle
CVE-2026-87370 (Vulnerability in the Oracle WebCenter Content product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87369 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87367 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- openjdk-8 <unfixed>
- openjdk-11 <unfixed>
@@ -2250,7 +2250,7 @@ CVE-2026-87366 (Vulnerability in the Oracle Applications Framework product of Or
CVE-2026-87365 (Vulnerability in the Oracle WebCenter Content product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87364 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87363 (Vulnerability in the Oracle Payroll product of Oracle E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-87362 (Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain ( ...)
@@ -2260,17 +2260,17 @@ CVE-2026-87361 (Vulnerability in the Oracle WebCenter Content product of Oracle
CVE-2026-87360 (Vulnerability in the Oracle WebCenter Content product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-87359 (Vulnerability in the Oracle Service Bus product of Oracle Fusion Middl ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87358 (Vulnerability in the Oracle General Ledger product of Oracle E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-87357 (Vulnerability in the Order Capture product of Oracle E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87356 (Vulnerability in the Applications Platform Engineering product of Orac ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87355 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87354 (Vulnerability in Oracle TimesTen In-Memory Database (component: Kubern ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-87353 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-87352 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
@@ -2528,11 +2528,11 @@ CVE-2026-83372 (Vulnerability in the PeopleSoft Enterprise PeopleTools product o
CVE-2026-83371 (Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-83370 (Vulnerability in the Sourcing product of Oracle E-Business Suite (comp ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83367 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83366 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-83363 (Vulnerability in the Oracle Contract Lifecycle Management for Public S ...)
NOT-FOR-US: Oracle
CVE-2026-83361 (Vulnerability in the Oracle Contract Lifecycle Management for Public S ...)
@@ -3010,11 +3010,11 @@ CVE-2026-101853 (Vulnerability in the Oracle Product Hub product of Oracle E-Bus
CVE-2026-101852 (Vulnerability in the Oracle Product Hub product of Oracle E-Business S ...)
NOT-FOR-US: Oracle
CVE-2026-101851 (Vulnerability in the Installed Base product of Oracle E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101850 (Vulnerability in the Installed Base product of Oracle E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101849 (Vulnerability in the Installed Base product of Oracle E-Business Suite ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101847 (Vulnerability in the Oracle Bills of Material product of Oracle E-Busi ...)
NOT-FOR-US: Oracle
CVE-2026-101846 (Vulnerability in the Oracle Purchasing product of Oracle E-Business Su ...)
@@ -3028,19 +3028,19 @@ CVE-2026-101843 (Vulnerability in the Production Scheduling product of Oracle E-
CVE-2026-101842 (Vulnerability in the Strategic Network Optimization product of Oracle ...)
TODO: check
CVE-2026-101841 (Vulnerability in the Global Order Promising product of Oracle E-Busine ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101840 (Vulnerability in the Oracle Contract Lifecycle Management for Public S ...)
NOT-FOR-US: Oracle
CVE-2026-101837 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101836 (Vulnerability in the iSupplier Portal product of Oracle E-Business Sui ...)
TODO: check
CVE-2026-101835 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101834 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101833 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101832 (Vulnerability in the Oracle Order Management product of Oracle E-Busin ...)
NOT-FOR-US: Oracle
CVE-2026-101831 (Vulnerability in the Oracle Quality product of Oracle E-Business Suite ...)
@@ -3082,7 +3082,7 @@ CVE-2026-101813 (Vulnerability in the Oracle Engineering product of Oracle E-Bus
CVE-2026-101812 (Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul p ...)
NOT-FOR-US: Oracle
CVE-2026-101810 (Vulnerability in the MySQL Router product of Oracle MySQL (component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101809 (Vulnerability in the Workflow product of Oracle E-Business Suite (comp ...)
NOT-FOR-US: Oracle
CVE-2026-101808 (Vulnerability in the Oracle Product Workbench product of Oracle E-Busi ...)
@@ -3136,7 +3136,7 @@ CVE-2026-101785 (Vulnerability in the MySQL Server, MySQL Cluster product of Ora
CVE-2026-101784 (Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MyS ...)
- mysql-9.7 <unfixed>
CVE-2026-101783 (Vulnerability in the MySQL Router product of Oracle MySQL (component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101782 (Vulnerability in the Oracle Applications Manager product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101781 (Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MyS ...)
@@ -3296,7 +3296,7 @@ CVE-2026-101705 (Vulnerability in the Oracle Common Applications product of Orac
CVE-2026-101704 (Vulnerability in the Oracle Concurrent Processing product of Oracle E- ...)
NOT-FOR-US: Oracle
CVE-2026-101703 (Vulnerability in the Pasta product of Oracle E-Business Suite (compone ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101701 (Vulnerability in the Oracle Concurrent Processing product of Oracle E- ...)
NOT-FOR-US: Oracle
CVE-2026-101700 (Vulnerability in the Oracle Application Object Library product of Orac ...)
@@ -3422,11 +3422,11 @@ CVE-2026-101635 (Vulnerability in the Oracle Mobile Field Service product of Ora
CVE-2026-101634 (Vulnerability in the Oracle Mobile Field Service product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101633 (Vulnerability in the MySQL Router product of Oracle MySQL (component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101632 (Vulnerability in the MySQL Router product of Oracle MySQL (component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101631 (Vulnerability in the MySQL Router product of Oracle MySQL (component: ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101630 (Vulnerability in the Oracle Advanced Outbound Telephony product of Ora ...)
NOT-FOR-US: Oracle
CVE-2026-101629 (Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MyS ...)
@@ -3488,7 +3488,7 @@ CVE-2026-101602 (Vulnerability in the Oracle Agile Product Lifecycle Management
CVE-2026-101601 (Vulnerability in Oracle GoldenGate (component: Vendor Access Module). ...)
NOT-FOR-US: Oracle
CVE-2026-101600 (Vulnerability in Oracle TimesTen In-Memory Database (component: TimesT ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101599 (Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualiza ...)
- virtualbox 7.2.22-dfsg-1
CVE-2026-101598 (Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualiza ...)
@@ -3634,7 +3634,7 @@ CVE-2026-101525 (Vulnerability in the Oracle Enterprise Manager for Siebel produ
CVE-2026-101524 (Vulnerability in the Oracle Enterprise Manager Base Platform product o ...)
NOT-FOR-US: Oracle
CVE-2026-101522 (Vulnerability in Oracle TimesTen In-Memory Database (component: TimesT ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101521 (Vulnerability in Oracle APEX (component: General). Supported versions ...)
TODO: check
CVE-2026-101520 (Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Fr ...)
@@ -5334,7 +5334,7 @@ CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursi
CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run synchronously o ...)
NOT-FOR-US: Eclipse
CVE-2026-107755 (Insufficient filtering of credentials in the _replicator database in A ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the ...)
NOT-FOR-US: Eclipse
CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers security co ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d9fb6af9d325d448bb3357623b633fc47078d3a4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d9fb6af9d325d448bb3357623b633fc47078d3a4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/36d8789e/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list