[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
02d63836 by Moritz Mühlenhoff at 2026-10-22T12:13:44+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -212,7 +212,7 @@ CVE-2026-86146 (Inconsistent interpretation of HTTP requests (HTTP request/respo
 CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any capabili ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source DataStream (SD ...)
-	TODO: check
+	NOT-FOR-US: OpenSCAP
 CVE-2026-84924 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-84923 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
@@ -286,9 +286,9 @@ CVE-2026-78116 (The Broadcom AFBR-S50 time-of-flight sensor driver double-comple
 CVE-2026-78066 (Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms ...)
 	- brpc <itp> (bug #1060006)
 CVE-2026-78058 (Uncontrolled resource consumption in the HTTP/2 (h2) receive path of A ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-78048 (A reachable-assertion flaw in the HPACK header-compression decoder of  ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-76531 (As part of Cisco's ongoing commitment to proactive security and produc ...)
 	TODO: check
 CVE-2026-76530 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -400,21 +400,21 @@ CVE-2026-76288 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and
 CVE-2026-76287 (In Splunk Enterprise versions below 10.4.4, a user that holds a role w ...)
 	NOT-FOR-US: Cisco
 CVE-2026-74758 (A heap use-after-free in the RTMP protocol component of Apache bRPC (v ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-74757 (Uncontrolled resource allocation in the mcpack2pb component in Apache  ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-74755 (An integer underflow in the mcpack2pb component of Apache bRPC (versio ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-70387 (Exposed dangerous method or function and Incorrect Authorization vulne ...)
-	TODO: check
+	NOT-FOR-US: OxygenOS
 CVE-2026-70386 (Improper neutralization of special elements used in an OS command ('OS ...)
-	TODO: check
+	NOT-FOR-US: OxygenOS
 CVE-2026-66392 (Apache bRPC versions before 1.18.0 validate the server certificate cha ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-61916 (Out-of-bounds reads in URL parsing and case-insensitive header lookup  ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-61902 (Apache bRPC versions before 1.18.0 do not consistently enforce the con ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-59562 (Missing authentication for critical function vulnerability in Apache I ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-59229 (The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a ha ...)
@@ -422,23 +422,23 @@ CVE-2026-59229 (The Legacy Pipe receiver protocol (handshake / sendPipeData) use
 CVE-2026-58663 (An authentication bypass vulnerability exists in Apache IoTDB's Thrift ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-58064 (The Redis protocol implementation in Apache bRPC allowed inline comman ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-56388 (The Redis server command parser in Apache bRPC accepts an empty RESP a ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-56387 (The RTMP AMF parser in Apache bRPC accepts AMF string lengths and arra ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-56386 (Integer underflow and out-of-bounds read in the HTTP/2 server DATA fra ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-54427 (Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allow ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-54426 (Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18 ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-54425 (Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC befo ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-53986 (Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Gi ...)
-	TODO: check
+	NOT-FOR-US: Girafit
 CVE-2026-48830 (Improper authentication in Apache bRPC through 1.17.0 allows a remote  ...)
-	TODO: check
+	- brpc <itp> (bug #1060006)
 CVE-2026-41114 (Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC d ...)
 	TODO: check
 CVE-2026-29001 (TastyIgniter through 4.4.5 contain a PHP object injection vulnerabilit ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/02d6383630f457a4f28ab4d56a355d2ac6107390

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/02d6383630f457a4f28ab4d56a355d2ac6107390
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/bfb1423d/attachment-0001.htm>