[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 23 08:22:17 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
976da517 by security tracker role at 2026-10-23T07:20:47+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-97785 (Improper authentication in AAD App Proxy allows an unauthorized attack ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-97635 (The Agent Zero Web UI before 1.15 does not correctly sanitize user-pro ...)
TODO: check
CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut ...)
@@ -7,57 +7,57 @@ CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a user may cause \u2
CVE-2026-96616 (Authentication tokens issued by the E3's web management interface on l ...)
TODO: check
CVE-2026-96293 (A cleartext storage of sensitive information vulnerability in WatchGua ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-96185 (Stack-based buffer overflow in Microsoft Exchange Online allows an aut ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-95721 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95720 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95719 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95718 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95717 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95716 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95715 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95714 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95713 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95712 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95711 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95710 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95709 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95708 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95707 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95706 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95705 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-95704 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-94502 (In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix comma ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-94482 (Next.js is a React framework for building full-stack web applications. ...)
- TODO: check
+ NOT-FOR-US: Next.js
CVE-2026-94268 (The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94267 (The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94264 (The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94262 (The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93471 (Improper Handling of Highly Compressed Data (Data Amplification) in es ...)
TODO: check
CVE-2026-93336 (Missing authorization in the unit resources download route in Canonica ...)
@@ -65,9 +65,9 @@ CVE-2026-93336 (Missing authorization in the unit resources download route in Ca
CVE-2026-92450 (The authentication framework used by affected Kiloview E3 NDI encoder ...)
TODO: check
CVE-2026-89410 (In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigg ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-89409 (In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85. ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-86696 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-86055 (Part-DB is an open source inventory management system for electronic c ...)
@@ -79,117 +79,117 @@ CVE-2026-86019 (Part-DB is an open source inventory management system for electr
CVE-2026-86018 (Part-DB is an open source inventory management system for electronic c ...)
TODO: check
CVE-2026-85080 (In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-85079 (In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response c ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-83938 (Missing authentication for critical function in Azure Kubernetes Confi ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-79956 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79955 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79895 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79894 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79893 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79892 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79891 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79890 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79889 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79888 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79887 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79886 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79885 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79884 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79883 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79882 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79881 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79880 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79879 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79878 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79877 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79876 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79875 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79874 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79873 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79872 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79871 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79870 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79869 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79868 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79867 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79866 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79865 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79864 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79863 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79862 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79861 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79860 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79859 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79858 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79857 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79856 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79855 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79854 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79853 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79852 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79851 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79850 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79849 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79848 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79847 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79846 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-79844 (No description provided)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78846 (AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overfl ...)
TODO: check
CVE-2026-78801 (An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fib ...)
@@ -205,11 +205,11 @@ CVE-2026-75507 (GraphQL-core is a Python port of the GraphQL.js reference implem
CVE-2026-67597
REJECTED
CVE-2026-66282 (In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period com ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-66281 (In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes comman ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-66279 (In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a mes ...)
- TODO: check
+ NOT-FOR-US: Silicon Labs
CVE-2026-63243 (An authentication vulnerability in the Bluetooth Low Energy (BLE) impl ...)
TODO: check
CVE-2026-61791 (OCO-Server is a self-hosted endpoint management application for comput ...)
@@ -235,9 +235,9 @@ CVE-2026-54238 (Supabase Realtime provides Broadcast, Presence, and Postgres Cha
CVE-2026-51954 (An issue in Webasyst Framework 4.0.3 and before allows a remote attack ...)
TODO: check
CVE-2026-21812 (HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmissio ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-21811 (HCL AppScan Azure Boards Plugin is potentially affected by an Informat ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-19678 (A server-side request forgery (SSRF) vulnerability in the unauthentica ...)
TODO: check
CVE-2026-19677 (An authentication bypass vulnerability in the public onPhase/ frevvo r ...)
@@ -245,15 +245,15 @@ CVE-2026-19677 (An authentication bypass vulnerability in the public onPhase/ fr
CVE-2026-16477 (CleanShot X for macOS insecurely deserializes untrusted data embedded ...)
TODO: check
CVE-2026-13599 (Missing authentication for critical function vulnerability in ABB Abil ...)
- TODO: check
+ NOT-FOR-US: ABB group
CVE-2026-13411 (Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements w ...)
TODO: check
CVE-2026-115638 (OpenStack Ironic through 39.0.1 allows a denial of service via a confi ...)
TODO: check
CVE-2026-115547 (An input validation issue in the Okta Access Gateway (OAG) Admin Conso ...)
- TODO: check
+ NOT-FOR-US: Okta
CVE-2026-115546 (Okta Access Gateway (OAG) does not validate the selected authenticatio ...)
- TODO: check
+ NOT-FOR-US: Okta
CVE-2026-115537 (A weakness has been identified in gedelumbung HospitalManagement up to ...)
TODO: check
CVE-2026-115536 (A security flaw has been discovered in gedelumbung HospitalManagement ...)
@@ -287,7 +287,7 @@ CVE-2026-115503 (Ghidra before 12.2 contains an improper handling of highly comp
CVE-2026-115502 (A missing authorization check allows anyone having access to a "link w ...)
TODO: check
CVE-2026-115497 (The Music Store \u2013 WordPress eCommerce plugin for WordPress is vul ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115496 (Overly informative error messages in the catalog functionality of KNIM ...)
TODO: check
CVE-2026-115494 (A flaw in the cross-site request forgery (CSRF) prevention of KNIME Bu ...)
@@ -309,15 +309,15 @@ CVE-2026-115450 (External Control of Assumed-Immutable Web Parameter (CWE-472) i
CVE-2026-115449 (A flaw was found in libslirp. When handling ICMP echo requests, the re ...)
TODO: check
CVE-2026-115424 (A flaw was found in the OpenShift client oc. When extracting container ...)
- TODO: check
+ NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-115419 (The A2A server component in Amazon Strands Agents SDK for Python befor ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115417 (Memory allocation with excessive size value in the MQTT 3.1.1 compatib ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115416 (Incorrect authorization checks in Amazon Athena engine version 3 query ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115414 (OS command injection in the Terraform hook in AWS SAM CLI before 1.166 ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115411 (crawlseo before version 0.2.4 contains a server-side request forgery v ...)
TODO: check
CVE-2026-115400 (crawlseo before version 0.2.5 contains a cleartext storage vulnerabili ...)
@@ -453,7 +453,7 @@ CVE-2026-115321 (Bytebase before 3.16.0 contains an authorization bypass vulnera
CVE-2026-115319 (fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexi ...)
TODO: check
CVE-2026-115253 (An incorrect permission assignment vulnerability in the WatchGuard Age ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-115249 (A flaw has been found in subhajitkhan online-clinic-management-system ...)
TODO: check
CVE-2026-115248 (A vulnerability was detected in subhajitkhan online-clinic-management- ...)
@@ -467,19 +467,19 @@ CVE-2026-115221 (A flaw was found in FreeIPA. An improper authorization check al
CVE-2026-115207 (A flaw was found in GNU patch. An attacker can achieve arbitrary file ...)
TODO: check
CVE-2026-114703 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114702 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114701 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114700 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114699 (Missing Authorization vulnerability in yoomoney \u042eKassa \u0434\u04 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114698 (Authorization Bypass Through User-Controlled Key vulnerability in myCr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114696 (Missing Authorization vulnerability in miniOrange Page Restriction Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114665 (Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in ...)
TODO: check
CVE-2026-114655 (libmongocrypt builds requests to external key management services (AWS ...)
@@ -509,7 +509,7 @@ CVE-2026-114644 (The MongoDB C# Driver's BSON library contains an uncontrolled r
CVE-2026-114643 (The MongoDB C# Driver writes GeoJSON extra members without checking wh ...)
TODO: check
CVE-2026-114625 (VeloCloud Orchestrator (VCO) on-prem has a security issue where this i ...)
- TODO: check
+ NOT-FOR-US: Arista Networks
CVE-2026-114620 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
TODO: check
CVE-2026-114619 (Authlib is a Python library which builds OAuth and OpenID Connect serv ...)
@@ -553,15 +553,15 @@ CVE-2026-114515 (OCO-Server is a self-hosted endpoint management application for
CVE-2026-114510 (Flexible GraphRAG is a Python framework for building graph and retriev ...)
TODO: check
CVE-2026-114487 (Missing authorization in the PAM AD computer import endpoint in Devolu ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114486 (Incorrect authorization in the Devolutions Gateway token generation in ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114485 (Insufficient protection of sensitive information in the user list endp ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-114348 (webpack-dev-server is a development server that provides live reloadin ...)
TODO: check
CVE-2026-114195 (Insertion of Sensitive Information into Externally-Accessible File or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-113876 (SmileCDR HAPI FHIR does not correctly check authorization for conditio ...)
TODO: check
CVE-2026-113875 (On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, i ...)
@@ -575,25 +575,25 @@ CVE-2026-113872 (multer is a middleware for Node.js that handles multipart/form-
CVE-2026-113582 (UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity ...)
TODO: check
CVE-2026-113501 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113500 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113499 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict on ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113472 (The Depicter \u2014 Popup & Slider Builder WordPress plugin before 4.8 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112845 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112842 (Missing Authorization vulnerability in Cozmoslabs Paid Member Subscrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112832 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112822 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112820 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112379 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112332 (Motor.NET before 0.19.0 contains an uncaught exception vulnerability i ...)
TODO: check
CVE-2026-112331 (Motor.NET before 0.19.0 contains a denial-of-service vulnerability tha ...)
@@ -601,39 +601,39 @@ CVE-2026-112331 (Motor.NET before 0.19.0 contains a denial-of-service vulnerabil
CVE-2026-112330 (Motor.NET before 0.19.0 contains a denial of service vulnerability tha ...)
TODO: check
CVE-2026-112327 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112313 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112312 (Missing Authorization vulnerability in ACF Extended ACF Extended acf-e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112311 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112242 (Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Bui ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112241 (Authentication Bypass by Spoofing vulnerability in Brainstorm Force Su ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112230 (The Popup Builder WordPress plugin before 4.4.6 does not perform auth ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112219 (The Download Monitor WordPress plugin before 5.3.5 does not correctly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112218 (Missing Authorization vulnerability in Ahmad Majestic Support majestic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112085 (webpack-dev-server is a development server that provides live reloadin ...)
TODO: check
CVE-2026-111982 (The User Profile Builder WordPress plugin before 4.0.5 does not verif ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111966 (The User Profile Builder WordPress plugin before 4.0.5 does not sanit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111851 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111842 (Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111830 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111738 (The Speed Optimizer WordPress plugin before 7.8.5 does not verify net ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111737 (The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise o ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111594 (InterSystems IRIS for Health has TLS/SSL encryption turned off by defa ...)
TODO: check
CVE-2026-111181 (body-parser is body parsing middleware for Node.js and Express. In ver ...)
@@ -643,37 +643,37 @@ CVE-2026-111100 (The ONVIF device service on the E3 responds to certain informat
CVE-2026-111079 (A flaw was found in Goose. When the terminal integration feature is en ...)
TODO: check
CVE-2026-110974 (The org.json parser in com.vaadin.external.google:android-json recurse ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-110894 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110893 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110825 (The ONVIF device service on affected Kiloview E3 NDI encoder firmware ...)
TODO: check
CVE-2026-110537 (The Essential Addons for Elementor WordPress plugin before 6.8.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110510 (The Essential Addons for Elementor WordPress plugin before 6.8.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110491 (The ONVIF service on the E3 can be rendered unresponsive by sending ma ...)
TODO: check
CVE-2026-110243 (The network management service on affected Kiloview E3 NDI encoder fir ...)
TODO: check
CVE-2026-110063 (Improper link resolution before file access ('link following') in VM I ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-109936 (The Otter Blocks WordPress plugin before 3.2.8 does not correctly bou ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109935 (The Otter Blocks WordPress plugin before 3.2.8 does not enforce its b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109934 (The Otter Blocks WordPress plugin before 3.2.8 does not correctly det ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109933 (The Otter Blocks WordPress plugin before 3.2.8 does not properly sani ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109198 (The Anti-Spam by CleanTalk \u2013 Spam Protection Without CAPTCHA plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109122 (The network management service on affected Kiloview E3 NDI encoder fir ...)
TODO: check
CVE-2026-108456 (Server-side request forgery (ssrf) in Azure AI Foundry allows an autho ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-108360 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
TODO: check
CVE-2026-108359 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
@@ -693,11 +693,11 @@ CVE-2026-106017 (Improper certificate validation in the OpenVPN 3 Core library v
CVE-2026-105265 (A vulnerability exists in the the time zone parameter and does not pro ...)
TODO: check
CVE-2026-105014 (Improper neutralization of special elements used in a command ('comman ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-104068 (JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-bas ...)
TODO: check
CVE-2026-102785 (Joomla Extension - yootheme.com - Unauthenticated remote code executio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2025-71434 (Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthen ...)
TODO: check
CVE-2025-69723 (A reflected cross-site scripting (XSS) vulnerability in localstack v4. ...)
@@ -727,7 +727,7 @@ CVE-2022-51021 (NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains
CVE-2021-48017 (OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an ...)
TODO: check
CVE-2021-48016 (DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: DedeCMS
CVE-2021-48015 (JeeWMS before commit 0a610e8 contains an unauthenticated path traversa ...)
TODO: check
CVE-2021-48014 (FineReport 9.0 contains a path traversal vulnerability in the /WebRepo ...)
@@ -745,7 +745,7 @@ CVE-2018-25439 (MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnera
CVE-2018-25438 (Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated ...)
TODO: check
CVE-2017-20290 (Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-s ...)
- TODO: check
+ NOT-FOR-US: Discourse
CVE-2017-20289 (Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contain ...)
TODO: check
CVE-2017-20288 (QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting v ...)
@@ -1722,7 +1722,7 @@ CVE-2026-110899 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-110884 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110803 (VaadinService.requestEnd() in Vaadin Framework 8 locks the session and ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-110744 (A flaw was found in multicluster-global-hub-operator-bundle. The opera ...)
NOT-FOR-US: multicluster-global-hub-operator-bundle
CVE-2026-110370 (Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins ...)
@@ -1746,7 +1746,7 @@ CVE-2026-109931 (The Infility Global WordPress plugin before 2.16.25 does not pe
CVE-2026-109927 (The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capab ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107588 (Vaadin Charts renders charts with the Highcharts library and pins an e ...)
- TODO: check
+ NOT-FOR-US: Vaadin
CVE-2026-107447 (The Contest Gallery WordPress plugin before 34.0.1 does not reliably v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107435 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -1798,11 +1798,11 @@ CVE-2026-105270 (Allocation of Resources Without Limits or Throttling vulnerabil
CVE-2026-105256 (The LatePoint WordPress plugin before 5.7.5 does not validate the clie ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104949 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are a ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104948 (WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are a ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104947 (WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing author ...)
- TODO: check
+ NOT-FOR-US: EnterpriseDB
CVE-2026-104642 (The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104641 (The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify ...)
@@ -4005,7 +4005,7 @@ CVE-2026-101844 (Vulnerability in the Oracle Concurrent Processing product of Or
CVE-2026-101843 (Vulnerability in the Production Scheduling product of Oracle E-Busines ...)
NOT-FOR-US: Oracle
CVE-2026-101842 (Vulnerability in the Strategic Network Optimization product of Oracle ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101841 (Vulnerability in the Global Order Promising product of Oracle E-Busine ...)
NOT-FOR-US: Oracle
CVE-2026-101840 (Vulnerability in the Oracle Contract Lifecycle Management for Public S ...)
@@ -4297,19 +4297,19 @@ CVE-2026-101694 (Vulnerability in the Oracle Mobile Field Service product of Ora
CVE-2026-101692 (Vulnerability in the Oracle Mobile Field Service product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101690 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101689 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101688 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101687 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101686 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101685 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101684 (Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway pr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101683 (Vulnerability in the Applications DBA product of Oracle E-Business Sui ...)
NOT-FOR-US: Oracle
CVE-2026-101682 (Vulnerability in the Applications DBA product of Oracle E-Business Sui ...)
@@ -4335,17 +4335,17 @@ CVE-2026-101673 (Vulnerability in the Oracle US Federal Human Resources product
CVE-2026-101672 (Vulnerability in the Oracle Call Center Technology product of Oracle E ...)
NOT-FOR-US: Oracle
CVE-2026-101671 (Vulnerability in the Oracle Email Center product of Oracle E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101670 (Vulnerability in the Oracle Email Center product of Oracle E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101669 (Vulnerability in the Oracle Public Sector Human Resources product of O ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101668 (Vulnerability in the Oracle Customer Care product of Oracle E-Business ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101667 (Vulnerability in the Oracle Trade Management product of Oracle E-Busin ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101666 (Vulnerability in the Oracle Trade Management product of Oracle E-Busin ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101665 (Vulnerability in the Oracle Mobile Field Service product of Oracle E-B ...)
NOT-FOR-US: Oracle
CVE-2026-101664 (Vulnerability in the Oracle Mobile Field Service product of Oracle E-B ...)
@@ -4573,17 +4573,17 @@ CVE-2026-101547 (Vulnerability in the Oracle Demand Planning product of Oracle S
CVE-2026-101546 (Vulnerability in the Oracle Materials Requirement Planning product of ...)
TODO: check
CVE-2026-101545 (Vulnerability in the Oracle Inventory Management product of Oracle E-B ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101544 (Vulnerability in the Oracle Payroll product of Oracle E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-101543 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101542 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101541 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101540 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101539 (Vulnerability in the Oracle Payroll product of Oracle E-Business Suite ...)
NOT-FOR-US: Oracle
CVE-2026-101538 (Vulnerability in the Oracle Order Management product of Oracle E-Busin ...)
@@ -4595,11 +4595,11 @@ CVE-2026-101536 (Vulnerability in the Oracle Cost Management product of Oracle E
CVE-2026-101535 (Vulnerability in the Oracle Sales Foundation product of Oracle E-Busin ...)
NOT-FOR-US: Oracle
CVE-2026-101534 (Vulnerability in the Oracle EDI Gateway product of Oracle E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101533 (Vulnerability in the Oracle EDI Gateway product of Oracle E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101532 (Vulnerability in the Oracle EDI Gateway product of Oracle E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101531 (Vulnerability in the Oracle Business Intelligence Enterprise Edition p ...)
NOT-FOR-US: Oracle
CVE-2026-101529 (Vulnerability in the Oracle Enterprise Manager for Oracle Database pro ...)
@@ -4617,11 +4617,11 @@ CVE-2026-101524 (Vulnerability in the Oracle Enterprise Manager Base Platform pr
CVE-2026-101522 (Vulnerability in Oracle TimesTen In-Memory Database (component: TimesT ...)
NOT-FOR-US: Oracle
CVE-2026-101521 (Vulnerability in Oracle APEX (component: General). Supported versions ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101520 (Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Fr ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101519 (Vulnerability in the Oracle EDI Gateway product of Oracle E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101518 (Vulnerability in the Oracle Enterprise Manager Base Platform product o ...)
NOT-FOR-US: Oracle
CVE-2026-101517 (Vulnerability in the Oracle Utilities Network Management System produc ...)
@@ -4646,25 +4646,25 @@ CVE-2026-101510 (Vulnerability in the Oracle Net Services component of Oracle Da
CVE-2026-101508 (Vulnerability in the Siebel CRM Integration product of Oracle Siebel C ...)
NOT-FOR-US: Oracle
CVE-2026-101507 (Vulnerability in Oracle Trusted Answer Search (component: PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101506 (Vulnerability in Oracle Trusted Answer Search (component: Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101505 (Vulnerability in Oracle Trusted Answer Search (component: Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101504 (Vulnerability in Oracle Trusted Answer Search (component: Application ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101503 (Vulnerability in Oracle Trusted Answer Search (component: PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101502 (Vulnerability in Oracle Trusted Answer Search (component: PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101501 (Vulnerability in Oracle Trusted Answer Search (component: PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101500 (Vulnerability in the Oracle Global Lifecycle Management OPatchAuto pro ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101499 (Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion M ...)
NOT-FOR-US: Oracle
CVE-2026-101498 (Vulnerability in Oracle Trusted Answer Search (component: PLSQL packag ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101497 (Vulnerability in the Oracle Identity Manager product of Oracle Fusion ...)
NOT-FOR-US: Oracle
CVE-2026-101495 (Vulnerability in the Siebel CRM Development product of Oracle Siebel C ...)
@@ -4726,7 +4726,7 @@ CVE-2026-101468 (Vulnerability in the Siebel CRM Deployment product of Oracle Si
CVE-2026-101467 (Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM ...)
NOT-FOR-US: Oracle
CVE-2026-101466 (Vulnerability in the Oracle EDI Gateway product of Oracle E-Business S ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101465 (Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CR ...)
NOT-FOR-US: Oracle
CVE-2026-101464 (Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CR ...)
@@ -4862,7 +4862,7 @@ CVE-2026-101400 (Vulnerability in the Siebel Apps - Marketing product of Oracle
CVE-2026-101399 (Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel ...)
NOT-FOR-US: Oracle
CVE-2026-101398 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101397 (Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel ...)
NOT-FOR-US: Oracle
CVE-2026-101396 (Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel ...)
@@ -4884,7 +4884,7 @@ CVE-2026-101389 (Vulnerability in the PeopleSoft Enterprise PeopleTools product
CVE-2026-101388 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
NOT-FOR-US: Oracle
CVE-2026-101387 (Vulnerability in the Oracle Capacity product of Oracle E-Business Suit ...)
- TODO: check
+ NOT-FOR-US: Oracle
CVE-2026-101386 (Vulnerability in Oracle REST Data Services (component: Core). Support ...)
NOT-FOR-US: Oracle
CVE-2026-101385 (Vulnerability in Oracle REST Data Services (component: Core). Support ...)
@@ -6352,9 +6352,9 @@ CVE-2026-113648 (ApostropheCMS is an open-source Node.js content management syst
CVE-2026-113643 (A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affect ...)
NOT-FOR-US: EspoCRM
CVE-2026-113620 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator Web ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, a ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-113613 (FlexGet before 3.20.7 contains a path traversal vulnerability in the d ...)
TODO: check
CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization vulnerabi ...)
@@ -6663,13 +6663,13 @@ CVE-2026-110180 (fast-uri is a dependency-free RFC 3986 URI parser and serialize
CVE-2026-109700 (Missing Authorization vulnerability in eLightUp Meta Box \u2013 WordPr ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108089 (** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system informati ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108088 (** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive info ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108087 (** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special ele ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108086 (** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive enti ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-108062 (Pre-authentication OIDC discovery and JWKS fetches run synchronously o ...)
NOT-FOR-US: Eclipse
CVE-2026-107755 (Insufficient filtering of credentials in the _replicator database in A ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/976da5174241a97b200723f20fc3816f2f95f853
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/976da5174241a97b200723f20fc3816f2f95f853
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/eef4e139/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list