[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Oct 22 17:30:53 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8fbae3c6 by Moritz Muehlenhoff at 2026-10-22T18:12:41+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -531,13 +531,13 @@ CVE-2026-114634 (WWBN AVideo before 29.4.0 contains a blind server-side request
 CVE-2026-114633 (WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerab ...)
 	NOT-FOR-US: WWBN AVideo
 CVE-2026-114577 (A vulnerability was found in oretnom23 php-travel-agency-system. This  ...)
-	TODO: check
+	NOT-FOR-US: php-travel-agency-system
 CVE-2026-114576 (A vulnerability has been found in Linksys RE6250 1.0.04.001. This affe ...)
 	NOT-FOR-US: Linksys
 CVE-2026-114575 (A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affec ...)
 	NOT-FOR-US: TOTOLINK
 CVE-2026-114574 (A security vulnerability has been detected in massCodeIO massCode 5.10 ...)
-	TODO: check
+	NOT-FOR-US: massCode
 CVE-2026-114570 (WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-114509 (Laravel is a web application framework. Prior to 12.68.0 and 13.29.0,  ...)
@@ -547,35 +547,35 @@ CVE-2026-114508 (Laravel is a web application framework. From 12.45.0 until 12.6
 CVE-2026-114501 (Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow ex ...)
 	TODO: check
 CVE-2026-114493 (LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery  ...)
-	TODO: check
+	NOT-FOR-US: LocalAI
 CVE-2026-114492 (gin-vue-admin through 2.9.2 contains a path traversal vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: gin-vue-admin
 CVE-2026-114491 (pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy()  ...)
 	TODO: check
 CVE-2026-114490 (Incorrect authorization in the COM administration API of Progressive R ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114489 (Missing authorization in the REST and COM administration APIs of Progr ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114479 (Not failing securely in the anti-virus attachment-stripping action of  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114478 (Insufficient preservation of the original sender in the forwarding of  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114477 (Missing authorization in the REST metrics route of Progressive Robot h ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114476 (Incorrect authorization in the REST administration API of Progressive  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114475 (Missing authorization in the REST role-management routes of Progressiv ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114474 (Use of a less trusted source for the envelope sender in the external-a ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114473 (Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progre ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114472 (Insufficient resource pool in the ACME HTTP-01 challenge responder of  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114471 (Insertion of sensitive information into a log file in the SMTP server  ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114470 (Cross-site request forgery in the REST API of Progressive Robot hMailS ...)
-	TODO: check
+	NOT-FOR-US: Progressive Robot
 CVE-2026-114463 (The webhook platform gateway in Nous Research Hermes Agent versions bu ...)
 	TODO: check
 CVE-2026-114462 (Improper link resolution before file access ('link following') vulnera ...)
@@ -589,13 +589,13 @@ CVE-2026-114458 (A flaw was found in mod_qos. An unauthenticated remote attacker
 CVE-2026-114457 (A flaw was found in mod_qos. An unauthenticated remote attacker could  ...)
 	TODO: check
 CVE-2026-114441 (A weakness has been identified in oretnom23 php-travel-agency-system.  ...)
-	TODO: check
+	NOT-FOR-US: php-travel-agency-system
 CVE-2026-114440 (A vulnerability was identified in oretnom23 php-travel-agency-system.  ...)
-	TODO: check
+	NOT-FOR-US: php-travel-agency-system
 CVE-2026-114439 (A vulnerability was determined in oretnom23 php-travel-agency-system.  ...)
-	TODO: check
+	NOT-FOR-US: php-travel-agency-system
 CVE-2026-114438 (A flaw was found in the Update User Locale required action of the Keyc ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-114437 (In the Golang Chi web framework, the ClientIPFromXFF middleware skips  ...)
 	TODO: check
 CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site scripting vulne ...)
@@ -603,11 +603,11 @@ CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site scriptin
 CVE-2026-114406 (The system certificate authority (CA) store in Red Hat products, distr ...)
 	TODO: check
 CVE-2026-114405 (Improper validation of array index vulnerability in Velneo vServer.Thi ...)
-	TODO: check
+	NOT-FOR-US: Velneo
 CVE-2026-114404 (PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulner ...)
-	TODO: check
+	NOT-FOR-US: PHPOffice
 CVE-2026-114403 (PHPOffice PHPPresentation through 1.2.0 contains an insecure deseriali ...)
-	TODO: check
+	NOT-FOR-US: PHPOffice
 CVE-2026-114402 (Trudesk through 1.2.11 contains a path traversal and authorization byp ...)
 	NOT-FOR-US: Trudesk
 CVE-2026-114401 (Trudesk through 1.2.11 contains a regular expression injection vulnera ...)
@@ -923,37 +923,37 @@ CVE-2026-107435 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-106053
 	REJECTED
 CVE-2026-105945 (The Pulsar Packages Management Service can be configured to store pack ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105944 (Apache Pulsar Manager is a web console for administering Apache Pulsar ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105942 (When a configured proxy role sends a request to the broker on behalf o ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105938 (Apache Pulsar namespaces can restrict which roles may use a subscripti ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105937 (Apache Pulsar shadow topics (PIP-180) are topics that read the stored  ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105936 (The Pulsar Functions worker REST API provides two endpoints that retur ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105935 (The Pulsar Functions Worker provides a REST API endpoint for triggerin ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105934 (The Apache Pulsar broker admin REST API provides a truncate operation  ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105933 (Apache Pulsar allows an administrator to require end-to-end message en ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105932 (The Apache Pulsar broker admin REST API provides endpoints to read, se ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105931 (The Apache Pulsar broker exposes a transaction administration REST API ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105930 (When package management is enabled, Pulsar Functions, Sources and Sink ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105927 (The Apache Pulsar WebSocket service allows a WebSocket consumer to con ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105926 (The Pulsar broker serves two schema commands on its binary protocol: G ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn triggers ...)
 	TODO: check
 CVE-2026-105869 (Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a clie ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-105777 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-105711 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
@@ -2384,7 +2384,7 @@ CVE-2026-87302 (Vulnerability in the Oracle WebLogic Server product of Oracle Fu
 CVE-2026-87301 (Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualiza ...)
 	- virtualbox 7.2.18-dfsg-1
 CVE-2026-87300 (Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of O ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-87299 (Vulnerability in the Oracle WebCenter Content product of Oracle Fusion ...)
 	NOT-FOR-US: Oracle
 CVE-2026-87298 (Vulnerability in the Oracle WebCenter Content product of Oracle Fusion ...)
@@ -2509,7 +2509,7 @@ CVE-2026-83380 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Ora
 	- openjdk-21 21.0.13+9-1
 	- openjdk-25 25.0.5+8-1
 CVE-2026-83379 (Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of O ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-83378 (Vulnerability in Oracle Java SE (component: Compiler).  Supported vers ...)
 	- openjdk-21 21.0.13+9-1
 	- openjdk-25 25.0.5+8-1
@@ -2660,15 +2660,15 @@ CVE-2026-114197 (Deserialization of untrusted data in Mandiant FLARE capa releas
 CVE-2026-114119 (Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded  ...)
 	TODO: check
 CVE-2026-114118 (Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in c ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2026-114117 (Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in wh ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2026-114116 (Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its sou ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2026-114115 (Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnera ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2026-114114 (Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2026-114113 (Sharp before 0.35.0 bundles a version of libvips affected by multiple  ...)
 	TODO: check
 CVE-2026-114112 (Sharp before 0.35.4 bundles a vulnerable libheif dependency that allow ...)
@@ -3032,7 +3032,7 @@ CVE-2026-101845 (Vulnerability in the Oracle Purchasing product of Oracle E-Busi
 CVE-2026-101844 (Vulnerability in the Oracle Concurrent Processing product of Oracle E- ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101843 (Vulnerability in the Production Scheduling product of Oracle E-Busines ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101842 (Vulnerability in the Strategic Network Optimization product of Oracle  ...)
 	TODO: check
 CVE-2026-101841 (Vulnerability in the Global Order Promising product of Oracle E-Busine ...)
@@ -3042,7 +3042,7 @@ CVE-2026-101840 (Vulnerability in the Oracle Contract Lifecycle Management for P
 CVE-2026-101837 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101836 (Vulnerability in the iSupplier Portal product of Oracle E-Business Sui ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101835 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101834 (Vulnerability in the Oracle Shipping Execution product of Oracle E-Bus ...)
@@ -3066,7 +3066,7 @@ CVE-2026-101826 (Vulnerability in the Oracle HCM Common Architecture product of
 CVE-2026-101825 (Vulnerability in the Oracle HCM Common Architecture product of Oracle  ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101824 (Vulnerability in the Document Management and Collaboration product of  ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101823 (Vulnerability in the Oracle Bills of Material product of Oracle E-Busi ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101822 (Vulnerability in the Oracle Bills of Material product of Oracle E-Busi ...)
@@ -3082,7 +3082,7 @@ CVE-2026-101818 (Vulnerability in the Oracle Product Hub product of Oracle E-Bus
 CVE-2026-101816 (Vulnerability in the Oracle Product Hub product of Oracle E-Business S ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101815 (Vulnerability in the Assets product of Oracle E-Business Suite (compon ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101814 (Vulnerability in the Oracle Engineering product of Oracle E-Business S ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101813 (Vulnerability in the Oracle Engineering product of Oracle E-Business S ...)
@@ -3238,9 +3238,9 @@ CVE-2026-101738 (Vulnerability in the Oracle Agile Engineering Data Management p
 CVE-2026-101737 (Vulnerability in Oracle Java SE (component: Compiler).   The supported ...)
 	- openjdk-26 <unfixed>
 CVE-2026-101736 (Vulnerability in the Primavera Unifier product of Oracle Construction  ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101735 (Vulnerability in the Primavera Unifier product of Oracle Construction  ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101734 (Vulnerability in the Oracle Agile Engineering Data Management product  ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101733 (Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MyS ...)
@@ -3734,7 +3734,7 @@ CVE-2026-101477 (Vulnerability in Oracle Autonomous Health Framework (component:
 CVE-2026-101476 (Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel  ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101475 (Vulnerability in the Primavera Unifier product of Oracle Construction  ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2026-101474 (Vulnerability in the Oracle Agile Product Lifecycle Management for Pro ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101473 (Vulnerability in the Oracle Agile Product Lifecycle Management for Pro ...)
@@ -3980,19 +3980,19 @@ CVE-2025-60494 (A segmentation violation in the gf_props_equal_internal function
 CVE-2025-60475 (A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_pa ...)
 	- gpac <removed>
 CVE-2021-48020 (Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2021-48019 (Vyper before 0.2.9 deploys forwarder proxies through the built-in crea ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2021-48018 (Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentr ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2020-37289 (Vyper before 0.3.1 lacks a uint8 type, allowing interface return value ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2020-37288 (Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2020-37287 (Vyper before 0.2.6 contains a call stack corruption vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2020-37286 (Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Vyper
 CVE-2016-20104 (EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain  ...)
 	TODO: check
 CVE-2016-20103 (Cherry Plugin for WordPress before 1.2.7 contains a path traversal vul ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8fbae3c6d4645a0c3f7a898ccb690f88ca9aad01

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8fbae3c6d4645a0c3f7a898ccb690f88ca9aad01
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/048854f8/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list