[Git][security-tracker-team/security-tracker][master] NFUs

Thu Oct 22 10:05:13 BST 2026


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7b2d596f by Moritz Mühlenhoff at 2026-10-22T10:50:58+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -145,7 +145,7 @@ CVE-2026-92183 (GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code E
 CVE-2026-91403 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
 	TODO: check
 CVE-2026-90484 (The MySQL client response parser in Apache bRPC dereferences a null po ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-89052 (A hardcoded cryptographic key management vulnerability exists in Arche ...)
 	NOT-FOR-US: TPLink
 CVE-2026-89035 (MikroTik RouterOS through 7.24.5 contains a session token replay vulne ...)
@@ -193,17 +193,17 @@ CVE-2026-87937 (URL Redirection to Untrusted Site ('Open Redirect') vulnerabilit
 CVE-2026-87936 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-87849 (The Discovery naming-service reply parser in Apache bRPC (versions < 1 ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-87096 (Sensitive information disclosure and manipulation due to improper auth ...)
 	NOT-FOR-US: Acronis
 CVE-2026-87095 (Sensitive information disclosure and manipulation due to improper auth ...)
 	NOT-FOR-US: Acronis
 CVE-2026-86249 (On a brpc::Server that sets both ServerOptions.auth and ServerOptions. ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-86147 (External control of file name or path and uncontrolled resource consum ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-86146 (Inconsistent interpretation of HTTP requests (HTTP request/response sm ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any capabili ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source DataStream (SD ...)
@@ -237,39 +237,39 @@ CVE-2026-84911 (Improper Neutralization of Input During Web Page Generation ("Cr
 CVE-2026-84910 (Missing Authorization vulnerability in Drupal Advanced Search allows F ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-84748 (Improper authorization in Apache bRPC (versions < 1.18.0) on all platf ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-84747 (Interpretation conflict in the HTTP protocol implementation in Apache  ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-84727 (Use-after-free in the RTMP protocol implementation in Apache bRPC (ver ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82987 (There exists a screen capture endpoint in vCast media streaming servic ...)
-	TODO: check
+	NOT-FOR-US: vCast
 CVE-2026-82953 (NULL pointer dereference in the RTMP protocol implementation in Apache ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82942 (A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) a ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82425 (A reachable assertion in Apache bRPC (version < 1.18.0) on all platfor ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82231 (A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRI ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82230 (Uncontrolled recursion in the mcpack2pb component in Apache bRPC (vers ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-82210 (Enforceable assertion in the streaming feature of Apache bRPC (version ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-81755 (Uncontrolled resource consumption in the streaming RPC component of Ap ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-81163 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-80463 (Unbounded memory accumulation in the stream message reassembly path of ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-79976 (The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpi ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-79704 (An out-of-bounds read vulnerability exists in the streaming RPC client ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-78392 (The Link Library WordPress plugin before 7.9.6 does not sanitise and e ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-78334 (Missing authentication in the streaming RPC path of Apache bRPC (versi ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-78119 (The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) reques ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-78118 (The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the h ...)
@@ -279,7 +279,7 @@ CVE-2026-78117 (The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hc
 CVE-2026-78116 (The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-78066 (Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-78058 (Uncontrolled resource consumption in the HTTP/2 (h2) receive path of A ...)
 	TODO: check
 CVE-2026-78048 (A reachable-assertion flaw in the HPACK header-compression decoder of  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b2d596f9ad6e9db2ddffba6d645fe036c19b03e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b2d596f9ad6e9db2ddffba6d645fe036c19b03e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/a7cf892d/attachment.htm>
