[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Oct 22 23:51:27 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b0aefa25 by Moritz Muehlenhoff at 2026-10-22T23:20:17+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -828,11 +828,11 @@ CVE-2026-114121 (Electron is a framework for writing cross-platform desktop appl
 CVE-2026-114120 (SchedulePress before 5.3.5 contains a missing authorization vulnerabil ...)
 	NOT-FOR-US: SchedulePress
 CVE-2026-113870 (MongoDB Compass improperly escapes certain BSON values when converting ...)
-	TODO: check
+	NOT-FOR-US: MongoDB Compass
 CVE-2026-113800 (Electron is a framework for writing cross-platform desktop application ...)
 	- electron <itp> (bug #842420)
 CVE-2026-113799 (Slack Morphism is a client library for Slack Web/Events API/Socket Mod ...)
-	TODO: check
+	NOT-FOR-US: Slack Morphism
 CVE-2026-113798 (Electron is a framework for writing cross-platform desktop application ...)
 	- electron <itp> (bug #842420)
 CVE-2026-113797 (Electron is a framework for writing cross-platform desktop application ...)
@@ -885,7 +885,7 @@ CVE-2026-113789 (pypdf is a free and open-source pure-python PDF library. Prior
 CVE-2026-113788 (Lagoon is an application delivery platform for Kubernetes. Versions pr ...)
 	NOT-FOR-US: Lagoon
 CVE-2026-113787 (odf-kit allows users to generate, fill, read, and convert OpenDocument ...)
-	TODO: check
+	NOT-FOR-US: odf-kit
 CVE-2026-113786 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
 	- pypdf 6.21.1-1
 	- pypdf2 <removed>
@@ -945,7 +945,7 @@ CVE-2026-111832 (Unrestricted Upload of File with Dangerous Type vulnerability i
 CVE-2026-111401 (Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tail ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111184 (NoMachine Named Pipe Incorrect Permission Assignment Local Privilege E ...)
-	TODO: check
+	NOT-FOR-US: NoMachine
 CVE-2026-111183 (GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution ...)
 	TODO: check
 CVE-2026-111075 (In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fa ...)
@@ -961,7 +961,7 @@ CVE-2026-110884 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-110803 (VaadinService.requestEnd() in Vaadin Framework 8 locks the session and ...)
 	TODO: check
 CVE-2026-110744 (A flaw was found in multicluster-global-hub-operator-bundle. The opera ...)
-	TODO: check
+	NOT-FOR-US: multicluster-global-hub-operator-bundle
 CVE-2026-110370 (Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-110369 (Deserialization of Untrusted Data vulnerability in GS Plugins WordPres ...)
@@ -1027,7 +1027,7 @@ CVE-2026-105777 (GitLab has remediated an issue in GitLab CE/EE affecting all ve
 CVE-2026-105711 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-105270 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: esaml
 CVE-2026-105256 (The LatePoint WordPress plugin before 5.7.5 does not validate the clie ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104949 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are a ...)
@@ -3007,9 +3007,9 @@ CVE-2026-113731 (djust provides Phoenix LiveView-style reactive server-side rend
 CVE-2026-113730 (OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13,  ...)
 	TODO: check
 CVE-2026-113729 (Moov signedxml is a pure Go library for processing signed XML document ...)
-	TODO: check
+	NOT-FOR-US: Moov signedxml
 CVE-2026-113728 (Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Serv ...)
-	TODO: check
+	NOT-FOR-US: Bulwark Webmail
 CVE-2026-113727 (OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1. ...)
 	NOT-FOR-US: OpenChoreo
 CVE-2026-113726 (virtualenv is a tool for creating isolated virtual python environments ...)
@@ -3081,17 +3081,17 @@ CVE-2026-113713 (virtualenv is a tool for creating isolated virtual python envir
 	NOTE: https://github.com/pypa/virtualenv/pull/3437
 	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e (21.14.10)
 CVE-2026-113712 (Cachet is an open-source status page system. Versions 2.4.1 and earlie ...)
-	TODO: check
+	NOT-FOR-US: Cachet
 CVE-2026-113707 (A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4.  ...)
-	TODO: check
+	NOT-FOR-US: a2a-rs
 CVE-2026-113706 (A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impac ...)
-	TODO: check
+	NOT-FOR-US: a2a-rs
 CVE-2026-113705 (A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This  ...)
-	TODO: check
+	NOT-FOR-US: a2a-rs
 CVE-2026-113704 (A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This  ...)
-	TODO: check
+	NOT-FOR-US: a2a-rs
 CVE-2026-112712 (@fastify/middie is the Express-style middleware engine for Fastify. In ...)
-	TODO: check
+	NOT-FOR-US: @fastify/middie
 CVE-2026-112407 (Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain ...)
 	NOT-FOR-US: Amazon
 CVE-2026-112380 (Missing authorization in the WhatsApp group channel in Kiro Crew might ...)
@@ -4172,7 +4172,7 @@ CVE-2026-101360 (Vulnerability in Oracle REST Data Services (component: Core).
 CVE-2026-101359 (Vulnerability in Oracle REST Data Services (component: Core).  Support ...)
 	NOT-FOR-US: Oracle
 CVE-2026-101103 (The PEAK-System PCAN diagnostic call did not validate that the caller- ...)
-	TODO: check
+	NOT-FOR-US: PEAK-System
 CVE-2026-100145 (The Synchrony Financing WordPress plugin before 1.1.2 does not properl ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-71437 (Astral uv before 0.8.22 contains a path traversal vulnerability in sou ...)
@@ -4198,39 +4198,39 @@ CVE-2020-37287 (Vyper before 0.2.6 contains a call stack corruption vulnerabilit
 CVE-2020-37286 (Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerabi ...)
 	NOT-FOR-US: Vyper
 CVE-2016-20104 (EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain  ...)
-	TODO: check
+	NOT-FOR-US: EyeLock nano NXT
 CVE-2016-20103 (Cherry Plugin for WordPress before 1.2.7 contains a path traversal vul ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2016-20102 (JavaMelody before 1.60.0 contains a reflected cross-site scripting vul ...)
-	TODO: check
+	NOT-FOR-US: JavaMelody
 CVE-2016-20101 (Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file incl ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2016-20100 (Memphis Documents Library plugin for WordPress before 3.1.6 contains a ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2015-20128 (FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: DotNetCMS
 CVE-2015-20125 (Aspose PDF Exporter plugin for WordPress before 2.0 contains a path tr ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2015-20124 (Aspose Importer & Exporter plugin for WordPress before 3.0 contains a  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2015-20123 (Aspose Doc Exporter plugin for WordPress before 2.0 contains a path tr ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2014-125134 (ChurcHope theme for WordPress before 2.2 contains a path traversal vul ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2014-125133 (NativeChurch theme for WordPress before 1.6.2 contains a path traversa ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2014-125132 (Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cr ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2014-125131 (DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerab ...)
 	NOT-FOR-US: DedeCMS
 CVE-2012-20005 (SocialFit plugin for WordPress through 1.2.2 contains a reflected cros ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2012-20004 (K-news plugin for WordPress before 1.1.1 contains a reflected cross-si ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2012-20003 (Custom Tables plugin for WordPress before 3.4.6 contains a reflected c ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2012-20002 (TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-113341 (Memory corruption in Skia in Google Chrome on on Android prior to 156. ...)
 	- chromium 156.0.8078.47-1
 	- libskia <unfixed> (unimportant)
@@ -5147,25 +5147,25 @@ CVE-2026-11960 (Enumeration of unauthenticated users in FacturaScripts, version
 CVE-2026-11959 (Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61,  ...)
 	NOT-FOR-US: FacturaScripts
 CVE-2026-113810 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
-	TODO: check
+	NOT-FOR-US: SNS
 CVE-2026-113808 (A Stored Cross-Site Scripting vulnerability exists in the SNS enrollme ...)
-	TODO: check
+	NOT-FOR-US: SNS
 CVE-2026-113802 (Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS c ...)
 	NOT-FOR-US: Wavlink
 CVE-2026-113711 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
-	TODO: check
+	NOT-FOR-US: ApostropheCMS
 CVE-2026-113710 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
-	TODO: check
+	NOT-FOR-US: ApostropheCMS
 CVE-2026-113709 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2026-113708 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2026-113703 (SuggestArr before 3.0.0 contains an authentication bypass vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: SuggestArr
 CVE-2026-113683 (VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a refle ...)
-	TODO: check
+	NOT-FOR-US: Moodle plugin
 CVE-2026-113682 (Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication  ...)
-	TODO: check
+	NOT-FOR-US: light-4j
 CVE-2026-113681 (OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3 ...)
 	TODO: check
 CVE-2026-113680 (HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference ...)
@@ -5173,11 +5173,11 @@ CVE-2026-113680 (HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dere
 CVE-2026-113679 (HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerab ...)
 	TODO: check
 CVE-2026-113678 (Froxlor before 2.3.15 contains a symlink following vulnerability in St ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-113677 (Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vul ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-113676 (Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vul ...)
-	TODO: check
+	- froxlor <itp> (bug #581792)
 CVE-2026-113672 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2026-113671 (ApostropheCMS is an open-source Node.js content management system. Fro ...)
@@ -5227,7 +5227,7 @@ CVE-2026-113649 (ApostropheCMS is an open-source Node.js content management syst
 CVE-2026-113648 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
 	NOT-FOR-US: ApostropheCMS
 CVE-2026-113643 (A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affect ...)
-	TODO: check
+	NOT-FOR-US: EspoCRM
 CVE-2026-113620 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator Web ...)
 	TODO: check
 CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, a ...)
@@ -5239,21 +5239,21 @@ CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization vu
 CVE-2026-113611 (Outline before 1.8.0 contains an improper access revocation vulnerabil ...)
 	TODO: check
 CVE-2026-113610 (Xen Orchestra before 6.9.0 contains an authorization bypass vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Xen Orchestra
 CVE-2026-113609 (Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to e ...)
-	TODO: check
+	NOT-FOR-US: Bandisoft Bandizip
 CVE-2026-113608 (Configurable Reports block for Moodle (moodle-block_configurablereport ...)
-	TODO: check
+	NOT-FOR-US: Moodle plugin
 CVE-2026-113607 (Configurable Reports block for Moodle before 5.3.0 contains an authori ...)
-	TODO: check
+	NOT-FOR-US: Moodle plugin
 CVE-2026-113606 (Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vuln ...)
 	TODO: check
 CVE-2026-113605 (Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist ...)
 	TODO: check
 CVE-2026-113604 (Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability  ...)
-	TODO: check
+	- ghidra <itp> (bug #923851)
 CVE-2026-113603 (The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28. ...)
-	TODO: check
+	NOT-FOR-US: x402 SIWX
 CVE-2026-113602 (json-smart through 2.6.0 contains an input validation bypass vulnerabi ...)
 	TODO: check
 CVE-2026-113601 (Memos before 0.27.0 contains a missing authorization vulnerability in  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b0aefa25ebca6f7796fe081499ae004c16913a67

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b0aefa25ebca6f7796fe081499ae004c16913a67
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/68a9ce42/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list