[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Oct 22 18:04:45 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
491a551b by Moritz Muehlenhoff at 2026-10-22T18:22:14+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -541,9 +541,9 @@ CVE-2026-114574 (A security vulnerability has been detected in massCodeIO massCo
 CVE-2026-114570 (WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-114509 (Laravel is a web application framework. Prior to 12.68.0 and 13.29.0,  ...)
-	TODO: check
+	NOT-FOR-US: Laravel
 CVE-2026-114508 (Laravel is a web application framework. From 12.45.0 until 12.68.0 and ...)
-	TODO: check
+	NOT-FOR-US: Laravel
 CVE-2026-114501 (Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow ex ...)
 	TODO: check
 CVE-2026-114493 (LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery  ...)
@@ -577,7 +577,7 @@ CVE-2026-114471 (Insertion of sensitive information into a log file in the SMTP
 CVE-2026-114470 (Cross-site request forgery in the REST API of Progressive Robot hMailS ...)
 	NOT-FOR-US: Progressive Robot
 CVE-2026-114463 (The webhook platform gateway in Nous Research Hermes Agent versions bu ...)
-	TODO: check
+	NOT-FOR-US: Hermes Agent
 CVE-2026-114462 (Improper link resolution before file access ('link following') vulnera ...)
 	TODO: check
 CVE-2026-114460 (A flaw was found in mod_qos. An off-by-one pointer calculation error o ...)
@@ -601,7 +601,7 @@ CVE-2026-114437 (In the Golang Chi web framework, the ClientIPFromXFF middleware
 CVE-2026-114407 (e107 CMS before 2.3.13 contains a reflected cross-site scripting vulne ...)
 	NOT-FOR-US: e107 CMS
 CVE-2026-114406 (The system certificate authority (CA) store in Red Hat products, distr ...)
-	TODO: check
+	NOT-FOR-US: Red Hat
 CVE-2026-114405 (Improper validation of array index vulnerability in Velneo vServer.Thi ...)
 	NOT-FOR-US: Velneo
 CVE-2026-114404 (PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulner ...)
@@ -719,7 +719,7 @@ CVE-2026-114243 (A security flaw has been discovered in dhikshitha29 Insurance-M
 CVE-2026-114242 (A vulnerability was identified in dhikshitha29 Insurance-Management-Sy ...)
 	NOT-FOR-US: Insurance-Management-System
 CVE-2026-114236 (storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when pr ...)
-	TODO: check
+	NOT-FOR-US: Red Hat
 CVE-2026-114223 (NT OneAPP developed by NewType Infortech has an Exposure of Sensitive  ...)
 	NOT-FOR-US: NT OneApp
 CVE-2026-114222 (NT OneAPP developed by NewType Infortech has an Authentication Bypass  ...)
@@ -745,13 +745,13 @@ CVE-2026-114175 (Missing Authorization vulnerability in DigitalME eRoom eroom-zo
 CVE-2026-114145 (GitPython is a python library used to interact with Git repositories.  ...)
 	TODO: check
 CVE-2026-114144 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
-	TODO: check
+	NOT-FOR-US: Node toml-node
 CVE-2026-114143 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
-	TODO: check
+	NOT-FOR-US: Node toml-node
 CVE-2026-114142 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
-	TODO: check
+	NOT-FOR-US: Node toml-node
 CVE-2026-114141 (toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1 ...)
-	TODO: check
+	NOT-FOR-US: Node toml-node
 CVE-2026-114140 (The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to v ...)
 	TODO: check
 CVE-2026-114139 (Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36 ...)
@@ -765,21 +765,21 @@ CVE-2026-114136 (Django REST framework is a toolkit for building Web APIs. From
 CVE-2026-114135 (Jupyter Server is the backend for Jupyter web applications. From 2.0.0 ...)
 	TODO: check
 CVE-2026-114133 (Nuxt is an open-source web development framework for Vue.js. From 3.13 ...)
-	TODO: check
+	NOT-FOR-US: Nuxt
 CVE-2026-114132 (Nuxt is an open-source web development framework for Vue.js. Prior to  ...)
-	TODO: check
+	NOT-FOR-US: Nuxt
 CVE-2026-114131 (Nuxt is an open-source web development framework for Vue.js. From 3.11 ...)
-	TODO: check
+	NOT-FOR-US: Nuxt
 CVE-2026-114130 (Nuxt is an open-source web development framework for Vue.js. Prior to  ...)
-	TODO: check
+	NOT-FOR-US: Nuxt
 CVE-2026-114129 (stream-json is a micro-library of stream components for processing JSO ...)
 	TODO: check
 CVE-2026-114128 (Astro is a web framework for content-driven websites. Prior to 7.3.2,  ...)
-	TODO: check
+	NOT-FOR-US: Astro
 CVE-2026-114127 (Astro is a web framework for content-driven websites. From 7.1.0 until ...)
-	TODO: check
+	NOT-FOR-US: Astro
 CVE-2026-114126 (Storybook is a frontend workshop for building user interface component ...)
-	TODO: check
+	NOT-FOR-US: Storybook
 CVE-2026-114125 (Storybook is a frontend workshop for building user interface component ...)
 	TODO: check
 CVE-2026-114124 (Electron is a framework for writing cross-platform desktop application ...)
@@ -819,7 +819,7 @@ CVE-2026-113790 (pypdf is a free and open-source pure-python PDF library. Prior
 CVE-2026-113789 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
 	TODO: check
 CVE-2026-113788 (Lagoon is an application delivery platform for Kubernetes. Versions pr ...)
-	TODO: check
+	NOT-FOR-US: Lagoon
 CVE-2026-113787 (odf-kit allows users to generate, fill, read, and convert OpenDocument ...)
 	TODO: check
 CVE-2026-113786 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
@@ -2654,11 +2654,11 @@ CVE-2026-28763 (A stack-based buffer overflow vulnerability exists in the boa fo
 CVE-2026-15261 (The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not en ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-114198 (Deserialization of untrusted data in Mandiant FLARE floss releases bef ...)
-	TODO: check
+	NOT-FOR-US: Mandiant
 CVE-2026-114197 (Deserialization of untrusted data in Mandiant FLARE capa releases befo ...)
-	TODO: check
+	NOT-FOR-US: Mandiant
 CVE-2026-114119 (Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded  ...)
-	TODO: check
+	NOT-FOR-US: Best Practice Software Bp Premier
 CVE-2026-114118 (Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in c ...)
 	NOT-FOR-US: Vyper
 CVE-2026-114117 (Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in wh ...)
@@ -2670,21 +2670,21 @@ CVE-2026-114115 (Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation
 CVE-2026-114114 (Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix ...)
 	NOT-FOR-US: Vyper
 CVE-2026-114113 (Sharp before 0.35.0 bundles a version of libvips affected by multiple  ...)
-	TODO: check
+	NOT-FOR-US: Sharp
 CVE-2026-114112 (Sharp before 0.35.4 bundles a vulnerable libheif dependency that allow ...)
-	TODO: check
+	NOT-FOR-US: Sharp
 CVE-2026-114111 (sharp before 0.35.5 bundles a librsvg dependency affected by a memory- ...)
-	TODO: check
+	NOT-FOR-US: Sharp
 CVE-2026-114110 (Astral uv before 0.11.6 contains a path traversal vulnerability that a ...)
 	TODO: check
 CVE-2026-114109 (uv before 0.11.15 contains a path traversal vulnerability that allows  ...)
 	TODO: check
 CVE-2026-114108 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authenti ...)
-	TODO: check
+	NOT-FOR-US: Vibe-Trading
 CVE-2026-114107 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt ...)
-	TODO: check
+	NOT-FOR-US: Vibe-Trading
 CVE-2026-114106 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal v ...)
-	TODO: check
+	NOT-FOR-US: Vibe-Trading
 CVE-2026-114105 (Adm-zip before 0.6.1 contains an incorrect permission assignment vulne ...)
 	TODO: check
 CVE-2026-114104 (adm-zip before 0.6.1 contains an inconsistent entry resolution vulnera ...)
@@ -2802,7 +2802,7 @@ CVE-2026-114049 (vLLM before 0.31.0 contains a cross-request mask leak in InputB
 CVE-2026-114048 (WWBN AVideo before 24.0 contains a cross-site request forgery vulnerab ...)
 	NOT-FOR-US: WWBN AVideo
 CVE-2026-114040 (A security vulnerability has been detected in DT42 BerryNet up to 3.10 ...)
-	TODO: check
+	NOT-FOR-US: DT42 BerryNet
 CVE-2026-114039 (A weakness has been identified in projectworlds Advanced Library Manag ...)
 	NOT-FOR-US: Project Worlds
 CVE-2026-114038 (A flaw was found in device-mapper-multipath. A local user can trigger  ...)
@@ -2826,7 +2826,7 @@ CVE-2026-113776 (virtualenv is a tool for creating isolated virtual python envir
 CVE-2026-113744 (A security vulnerability has been detected in Tenda AC19 16.03.10.07.  ...)
 	NOT-FOR-US: Tenda
 CVE-2026-113743 (A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. T ...)
-	TODO: check
+	NOT-FOR-US: Tenstorrent tt-metal
 CVE-2026-113741 (A vulnerability has been found in itsourcecode Online Cake Ordering Sy ...)
 	NOT-FOR-US: itsourcecode System
 CVE-2026-113740 (A flaw has been found in itsourcecode Online Cake Ordering System 1.0. ...)
@@ -2842,7 +2842,7 @@ CVE-2026-113735 (A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Af
 CVE-2026-113732 (virtualenv is a tool for creating isolated virtual python environments ...)
 	TODO: check
 CVE-2026-113731 (djust provides Phoenix LiveView-style reactive server-side rendering f ...)
-	TODO: check
+	NOT-FOR-US: djust
 CVE-2026-113730 (OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13,  ...)
 	TODO: check
 CVE-2026-113729 (Moov signedxml is a pure Go library for processing signed XML document ...)
@@ -2850,7 +2850,7 @@ CVE-2026-113729 (Moov signedxml is a pure Go library for processing signed XML d
 CVE-2026-113728 (Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Serv ...)
 	TODO: check
 CVE-2026-113727 (OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1. ...)
-	TODO: check
+	NOT-FOR-US: OpenChoreo
 CVE-2026-113726 (virtualenv is a tool for creating isolated virtual python environments ...)
 	TODO: check
 CVE-2026-113725 (virtualenv is a tool for creating isolated virtual python environments ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/491a551bc43e3d1cfec26ef44722b0cdc5f28e8e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/491a551bc43e3d1cfec26ef44722b0cdc5f28e8e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/d4148c1f/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list