[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 22 12:55:28 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
dee8492c by Salvatore Bonaccorso at 2026-10-22T13:30:59+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -291,39 +291,39 @@ CVE-2026-78058 (Uncontrolled resource consumption in the HTTP/2 (h2) receive pat
CVE-2026-78048 (A reachable-assertion flaw in the HPACK header-compression decoder of ...)
- brpc <itp> (bug #1060006)
CVE-2026-76531 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76530 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76529 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76528 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76527 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76526 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76524 (A vulnerability in the control channel socket implementation of O ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76505 (A vulnerability in the IPv4 packet processing functionality of Cisco I ...)
NOT-FOR-US: Cisco
CVE-2026-76497 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76496 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76495 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76494 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76493 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76492 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76491 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76490 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76489 (Multiple Cisco products are affected by a vulnerability in the memory ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76487 (A vulnerability in Cisco Unified Communications Manager (Unified CM) a ...)
NOT-FOR-US: Cisco
CVE-2026-76481 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -343,17 +343,17 @@ CVE-2026-76474 (As part of Cisco's ongoing commitment to proactive security and
CVE-2026-76473 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-76466 (A vulnerability in the database service feature of Cisco Expressway Se ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76462 (A vulnerability in the interprocess communication (IPC) channel of the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76445 (Multiple Cisco products are affected by a vulnerability in the Snort 3 ...)
TODO: check
CVE-2026-76435 (A vulnerability in Cisco Expressway Series could allow an unauthentica ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76408 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76407 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76406 (In Splunk SOAR versions below 8.7.0, an unauthenticated user with acce ...)
NOT-FOR-US: Cisco
CVE-2026-76308 (In Splunk SOAR versions below 8.7.0, an authenticated user could chang ...)
@@ -369,13 +369,13 @@ CVE-2026-76304 (In Splunk SOAR versions below 8.7.0, an authenticated user who d
CVE-2026-76303 (In Splunk SOAR versions below 8.7.0, a user that holds a role with the ...)
NOT-FOR-US: Cisco
CVE-2026-76302 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76301 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76300 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76299 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-76298 (In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does ...)
NOT-FOR-US: Cisco
CVE-2026-76297 (In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.1 ...)
@@ -441,9 +441,9 @@ CVE-2026-53986 (Girafit camera app (Android and iOS) version 1.9.1 and earlier,
CVE-2026-48830 (Improper authentication in Apache bRPC through 1.17.0 allows a remote ...)
- brpc <itp> (bug #1060006)
CVE-2026-41114 (Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC d ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-29001 (TastyIgniter through 4.4.5 contain a PHP object injection vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: TastyIgniter
CVE-2026-20356 (As part of Cisco's ongoing commitment to proactive security and produc ...)
TODO: check
CVE-2026-20291 (As part of Cisco's ongoing commitment to proactive security and produc ...)
@@ -471,7 +471,7 @@ CVE-2026-19676 (The user-mode verifier for the peci_transfer() system call, z_vr
CVE-2026-18748 (The Bluetooth Classic A2DP host stores a codec Information Element (IE ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-17557 (A flaw was found in the `lm-evaluation-harness` component of Red Hat O ...)
- TODO: check
+ NOT-FOR-US: Red Hat OpenShift AI
CVE-2026-16648 (Insertion of Sensitive Information into Log File vulnerability in Drup ...)
NOT-FOR-US: Drupal core and addons
CVE-2026-16255 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
@@ -489,19 +489,19 @@ CVE-2026-12664 (GitLab has remediated an issue in GitLab CE/EE affecting all ver
CVE-2026-114664 (Frappe Framework before 16.33.0 contains a blind SQL injection vulnera ...)
NOT-FOR-US: Frappe
CVE-2026-114663 (Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omi ...)
- TODO: check
+ NOT-FOR-US: Vyper
CVE-2026-114662 (Obot before 0.26.0 contains an authentication bypass vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Obot
CVE-2026-114661 (OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulner ...)
- TODO: check
+ NOT-FOR-US: OpenRemote
CVE-2026-114660 (Grav from 2.0.0 before 2.2.5 contains an improper access control vulne ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-114659 (Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-114658 (Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authoriz ...)
- TODO: check
+ NOT-FOR-US: Grav plugin
CVE-2026-114657 (Grav from 2.0.0 before 2.2.5 contains an information disclosure vulner ...)
- TODO: check
+ NOT-FOR-US: Grav CMS
CVE-2026-114656 (Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vu ...)
- traefik <itp> (bug #983289)
CVE-2026-114642 (Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/ ...)
@@ -2550,7 +2550,7 @@ CVE-2026-83139 (Vulnerability in the Oracle Order Management product of Oracle E
CVE-2026-82891 (IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attac ...)
NOT-FOR-US: IBM
CVE-2026-82819 (A vulnerability in Cerberus FTP Server allows an authenticated remote ...)
- TODO: check
+ NOT-FOR-US: Cerberus FTP Server
CVE-2026-82814 (The Duplicator and Duplicator Pro plugins for WordPress are vulnerable ...)
NOT-FOR-US: WordPress plugin
CVE-2026-81813 (The Elementor Website Builder WordPress plugin before 4.3.5 does not ...)
@@ -4856,55 +4856,55 @@ CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache To
CVE-2026-48279
REJECTED
CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a remote authe ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43857 (A vulnerability could allow a remote authenticated attacker to achieve ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43856 (A stack-based buffer overflow vulnerability in the FileProcess::CheckD ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43855 (A heap-based buffer overflow vulnerability could allow a remote authen ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43854 (A vulnerability could allow an attacker with access to an encrypted pr ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43853 (A vulnerability could allow an attacker to send a crafted message to t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43852 (A vulnerability could allow an authenticated attacker to write files t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43851 (A path traversal vulnerability could allow an authenticated attacker t ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43850 (A command injection vulnerability could allow an authenticated attacke ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43849 (A heap memory read vulnerability could allow an attacker to exfiltrate ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43848 (A vulnerability in the bulk port configuration functionality could all ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43847 (A vulnerability in the proprietary protocol could allow an attacker to ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43846 (A stack-based buffer overflow vulnerability in a non-functional featur ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43845 (A vulnerability in the password reset mechanism could allow an attacke ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43844 (A vulnerability in the proprietary protocol could allow an attacker to ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43843 (An integer overflow vulnerability in the license manager service could ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43842 (A NULL pointer dereference vulnerability in the license manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43841 (A NULL pointer dereference vulnerability in the license manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43840 (A NULL pointer dereference vulnerability in the license manager servic ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43839 (A NULL pointer dereference vulnerability in the logs management functi ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43838 (A stack-based buffer overflow vulnerability in the login functionality ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43837 (A buffer overflow vulnerability in the password verification functiona ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43836 (A vulnerability could allow an attacker to forge a packet to execute a ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43835 (A vulnerability in the firmware upgrade functionality could allow an a ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-43834 (A stack-based buffer overflow vulnerability in the logs settings funct ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2026-34485 (Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulne ...)
NOT-FOR-US: Nokia
CVE-2026-34484 (Nokia 1830 Global Express GX is vulnerable to a local privilege escala ...)
@@ -4924,13 +4924,13 @@ CVE-2026-21270
CVE-2026-21266
REJECTED
CVE-2026-18205 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: Ticimax E-Commerce Platform
CVE-2026-14933 (Cross-site scripting in the embedded co-browsing feature in Unblu inc. ...)
- TODO: check
+ NOT-FOR-US: Unblu
CVE-2026-11960 (Enumeration of unauthenticated users in FacturaScripts, version 2025.6 ...)
- TODO: check
+ NOT-FOR-US: FacturaScripts
CVE-2026-11959 (Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, ...)
- TODO: check
+ NOT-FOR-US: FacturaScripts
CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
TODO: check
CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
@@ -106213,9 +106213,9 @@ CVE-2026-20339 (A vulnerability in the PESpin file format parser of ClamAV could
[trixie] - clamav 1.4.6+dfsg-1~deb13u1
NOTE: https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html
CVE-2026-20338 (A vulnerability in the zip archive parser of ClamAV could allow an una ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20337 (A vulnerability in the zip archive parser of ClamAV could allow an una ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-19264 (Postiz is an open-source social media scheduling tool. The route that ...)
NOT-FOR-US: Postiz
CVE-2026-19231 (A security flaw has been discovered in SourceCodester Simple Doctors A ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee8492c605b12cac6ab43a77fbeab50b4ad30c0
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dee8492c605b12cac6ab43a77fbeab50b4ad30c0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/ead59046/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list