[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Oct 22 11:43:40 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c70fe0b9 by Moritz Mühlenhoff at 2026-10-22T12:29:56+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -974,7 +974,7 @@ CVE-2026-103301 (The Payment Gateway for Telcell WordPress plugin before 2.0.5 d
CVE-2026-103234 (The WP Ultimate Review WordPress plugin before 2.4.5 does not neutrali ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103090 (Missing Authentication for Critical Function (CWE-306) and Insufficien ...)
- TODO: check
+ NOT-FOR-US: Google SAM
CVE-2026-102536
REJECTED
CVE-2026-101138 (The CMP \u2013 Coming Soon & Maintenance WordPress plugin before 4.1.2 ...)
@@ -984,29 +984,29 @@ CVE-2026-100420 (A sensitive information disclosure vulnerability in the cloud-c
CVE-2026-100142 (The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 d ...)
NOT-FOR-US: WordPress plugin
CVE-2025-71438 (An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60497 (A segmentation violation in the GetESD function (/isomedia/track.c) of ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60493 (A segmentation violation in the check_media_profile function (/mp4box/ ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60492 (A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode. ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60491 (A heap use-after-free in the dasher_flush_segment function (/filters/d ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60490 (A heap use-after-free in the gf_filter_pid_send_event_downstream funct ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60489 (A NULL pointer dereference in the dasher_insert_timeline_entry functio ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60487 (A segmentation violation in the gf_isom_get_esd function (/isomedia/is ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60479 (A NULL pointer dereference in the StatSFVec2f function (/scene_manager ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60478 (A use-after-free in the gf_filter_packet_destroy function (/filter_cor ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60476 (A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/ ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60469 (A NULL pointer dereference in the gf_ac4_presentation_ch_mode function ...)
- TODO: check
+ - gpac <removed>
CVE-2025-0326 (The system fails to invalidate existing access tokens associated with ...)
NOT-FOR-US: WSO2
CVE-2024-7478 (When a WSO2 product is configured to use an external user store, the s ...)
@@ -2821,9 +2821,9 @@ CVE-2026-113741 (A vulnerability has been found in itsourcecode Online Cake Orde
CVE-2026-113740 (A flaw has been found in itsourcecode Online Cake Ordering System 1.0. ...)
NOT-FOR-US: itsourcecode System
CVE-2026-113738 (A vulnerability has been found in R6410418 Jackrong-llm-finetuning-gui ...)
- TODO: check
+ NOT-FOR-US: Jackrong-llm-finetuning-guide
CVE-2026-113737 (A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ...)
- TODO: check
+ NOT-FOR-US: Jackrong-llm-finetuning-guide
CVE-2026-113736 (A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The imp ...)
NOT-FOR-US: D-Link
CVE-2026-113735 (A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected ...)
@@ -2923,7 +2923,7 @@ CVE-2026-110523 (The WP User Manager WordPress plugin before 2.9.26 does not ke
CVE-2026-110514 (The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not che ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110322 (The PEAK-System PCAN type 0x4030 processing path fails to validate a s ...)
- TODO: check
+ NOT-FOR-US: PEAK-System
CVE-2026-10141 (A Unsigned Firmware vulnerability exists in the boa Firmware Update fu ...)
NOT-FOR-US: TOTOLINK
CVE-2026-10139 (A stack-based buffer overflow vulnerability exists in the Mcli functio ...)
@@ -2945,11 +2945,11 @@ CVE-2026-10131 (An OS command injection vulnerability exists in the boa formPass
CVE-2026-109926 (The Productive Commerce WordPress plugin before 1.1.49 does not perfo ...)
NOT-FOR-US: WordPress plugin
CVE-2026-109682 (Metasploit Framework versions before 6.5.7 allow HTTP requests made th ...)
- TODO: check
+ NOT-FOR-US: Metasploit Framework
CVE-2026-109681 (The FTP client trusts the server's PASV response IP:port without valid ...)
- TODO: check
+ NOT-FOR-US: Metasploit Framework
CVE-2026-109576 (The parser in PEAK-System PCAN driver correctly detected the malformed ...)
- TODO: check
+ NOT-FOR-US: PEAK-System
CVE-2026-109147 (The WP Booking System WordPress plugin before 2.1.0.3 does not valida ...)
NOT-FOR-US: WordPress plugin
CVE-2026-108073 (The SureCart WordPress plugin before 4.9.5 does not restrict which re ...)
@@ -2961,7 +2961,7 @@ CVE-2026-107789 (The SmartyParcel WordPress plugin before 1.23.4 does not perfo
CVE-2026-107788 (The SmartyParcel WordPress plugin before 1.23.4 does not perform auth ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107692 (The War Thunder game client transmits its authentication bearer token ...)
- TODO: check
+ NOT-FOR-US: War Thunder
CVE-2026-107506 (The Simple Banner WordPress plugin before 3.3.3 does not correctly li ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107237 (The Backup and Staging by WP Time Capsule WordPress plugin before 1.22 ...)
@@ -2981,15 +2981,15 @@ CVE-2026-105996 (The Booking Package WordPress plugin before 1.7.31 does not gen
CVE-2026-105992 (The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105960 (PEAK-System PCAN contains a vulnerable operation involving a variable- ...)
- TODO: check
+ NOT-FOR-US: PEAK-System
CVE-2026-105262 (The Falang multilanguage for WordPress plugin before 1.4.6 does not pe ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105257 (The Appointment Booking Plugin WordPress plugin before 5.7.5 does not ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105044 (Improper Neutralization of Special Elements used in an OS Command inSe ...)
- TODO: check
+ NOT-FOR-US: Qingteng
CVE-2026-103672 (The PEAK-System PCAN parser indexes a length table using attacker-cont ...)
- TODO: check
+ NOT-FOR-US: PEAK-System
CVE-2026-103302 (The Payment Gateway for Idram WordPress plugin before 2.1.6 does not v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-102499 (The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern ...)
@@ -3963,11 +3963,11 @@ CVE-2026-100145 (The Synchrony Financing WordPress plugin before 1.1.2 does not
CVE-2025-71437 (Astral uv before 0.8.22 contains a path traversal vulnerability in sou ...)
TODO: check
CVE-2025-60496 (A Floating-Point Exception (FPE) in the reframer_send_packet function ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60494 (A segmentation violation in the gf_props_equal_internal function (/fil ...)
- TODO: check
+ - gpac <removed>
CVE-2025-60475 (A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_pa ...)
- TODO: check
+ - gpac <removed>
CVE-2021-48020 (Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerabi ...)
TODO: check
CVE-2021-48019 (Vyper before 0.2.9 deploys forwarder proxies through the built-in crea ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c70fe0b9e881eb6900b656290deb5c9ba9a42354
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c70fe0b9e881eb6900b656290deb5c9ba9a42354
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/48b44e04/attachment.htm>
More information about the debian-security-tracker-commits
mailing list