[Git][security-tracker-team/security-tracker][master] Process some new NFUs

Thu Oct 22 23:01:55 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3e92b9a9 by Salvatore Bonaccorso at 2026-10-22T22:03:35+02:00
Process some new NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -596,7 +596,7 @@ CVE-2026-114470 (Cross-site request forgery in the REST API of Progressive Robot
 CVE-2026-114463 (The webhook platform gateway in Nous Research Hermes Agent versions bu ...)
 	NOT-FOR-US: Hermes Agent
 CVE-2026-114462 (Improper link resolution before file access ('link following') vulnera ...)
-	TODO: check
+	NOT-FOR-US: Velneo
 CVE-2026-114460 (A flaw was found in mod_qos. An off-by-one pointer calculation error o ...)
 	- mod-qos <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2558401
@@ -775,7 +775,7 @@ CVE-2026-114141 (toml-node is a TOML parser for Node.js and the browser. Prior t
 CVE-2026-114140 (The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to v ...)
 	TODO: check
 CVE-2026-114139 (Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36 ...)
-	TODO: check
+	NOT-FOR-US: Sentry-Javascript
 CVE-2026-114138 (Django REST framework is a toolkit for building Web APIs. Prior to 3.1 ...)
 	- djangorestframework 3.18.3+ds1-1
 	NOTE: https://github.com/encode/django-rest-framework/security/advisories/GHSA-33wh-fxxf-88vv
@@ -799,7 +799,7 @@ CVE-2026-114131 (Nuxt is an open-source web development framework for Vue.js. Fr
 CVE-2026-114130 (Nuxt is an open-source web development framework for Vue.js. Prior to  ...)
 	NOT-FOR-US: Nuxt
 CVE-2026-114129 (stream-json is a micro-library of stream components for processing JSO ...)
-	TODO: check
+	NOT-FOR-US: stream-json
 CVE-2026-114128 (Astro is a web framework for content-driven websites. Prior to 7.3.2,  ...)
 	NOT-FOR-US: Astro
 CVE-2026-114127 (Astro is a web framework for content-driven websites. From 7.1.0 until ...)
@@ -807,17 +807,17 @@ CVE-2026-114127 (Astro is a web framework for content-driven websites. From 7.1.
 CVE-2026-114126 (Storybook is a frontend workshop for building user interface component ...)
 	NOT-FOR-US: Storybook
 CVE-2026-114125 (Storybook is a frontend workshop for building user interface component ...)
-	TODO: check
+	NOT-FOR-US: Storybook
 CVE-2026-114124 (Electron is a framework for writing cross-platform desktop application ...)
 	- electron <itp> (bug #842420)
 CVE-2026-114123 (D365 F&O MCP Server is a Model Context Protocol server for querying Dy ...)
-	TODO: check
+	NOT-FOR-US: D365 F&O MCP Server
 CVE-2026-114122 (Electron is a framework for writing cross-platform desktop application ...)
 	- electron <itp> (bug #842420)
 CVE-2026-114121 (Electron is a framework for writing cross-platform desktop application ...)
 	- electron <itp> (bug #842420)
 CVE-2026-114120 (SchedulePress before 5.3.5 contains a missing authorization vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: SchedulePress
 CVE-2026-113870 (MongoDB Compass improperly escapes certain BSON values when converting ...)
 	TODO: check
 CVE-2026-113800 (Electron is a framework for writing cross-platform desktop application ...)
@@ -2827,19 +2827,19 @@ CVE-2026-114107 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect
 CVE-2026-114106 (HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal v ...)
 	NOT-FOR-US: Vibe-Trading
 CVE-2026-114105 (Adm-zip before 0.6.1 contains an incorrect permission assignment vulne ...)
-	TODO: check
+	NOT-FOR-US: Adm-zip
 CVE-2026-114104 (adm-zip before 0.6.1 contains an inconsistent entry resolution vulnera ...)
-	TODO: check
+	NOT-FOR-US: Adm-zip
 CVE-2026-114103 (adm-zip 0.6.0 contains a decompression bomb protection bypass that all ...)
-	TODO: check
+	NOT-FOR-US: Adm-zip
 CVE-2026-114102 (adm-zip before 0.6.1 contains a denial of service vulnerability that a ...)
-	TODO: check
+	NOT-FOR-US: Adm-zip
 CVE-2026-114101 (Coraza before 3.8.1 extracts multipart upload filenames with Go's mime ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-114100 (Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypa ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-114099 (Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens ...)
-	TODO: check
+	NOT-FOR-US: Coraza WAF
 CVE-2026-114098 (Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerabili ...)
 	TODO: check
 CVE-2026-114097 (Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerabili ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3e92b9a96c95b23b6e5e5664daf403aeef2fb6fb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3e92b9a96c95b23b6e5e5664daf403aeef2fb6fb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/6afed347/attachment.htm>
