[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 23 10:07:16 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7570d6d8 by Salvatore Bonaccorso at 2026-10-23T11:06:37+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -74,15 +74,15 @@ CVE-2026-89410 (In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can
 CVE-2026-89409 (In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85. ...)
 	NOT-FOR-US: Silicon Labs
 CVE-2026-86696 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: dropbox esaml
 CVE-2026-86055 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-86020 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-86019 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-86018 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-85080 (In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message ...)
 	NOT-FOR-US: Silicon Labs
 CVE-2026-85079 (In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response c ...)
@@ -196,13 +196,13 @@ CVE-2026-79846 (No description provided)
 CVE-2026-79844 (No description provided)
 	NOT-FOR-US: HPE
 CVE-2026-78846 (AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overfl ...)
-	TODO: check
+	NOT-FOR-US: AiDot Linkind Matter Smart Plug
 CVE-2026-78801 (An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fib ...)
-	TODO: check
+	NOT-FOR-US: SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M)
 CVE-2026-77157 (ast-cli downloads two helper binaries, the Vorpal ASCA real-time engin ...)
-	TODO: check
+	NOT-FOR-US: Checkmarx/ast-cli
 CVE-2026-77156 (Incomplete validation of extracted archive entry paths in ast-cli's ta ...)
-	TODO: check
+	NOT-FOR-US: Checkmarx/ast-cli
 CVE-2026-75508 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
 	TODO: check
 CVE-2026-75507 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
@@ -216,39 +216,39 @@ CVE-2026-66281 (In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes
 CVE-2026-66279 (In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a mes ...)
 	NOT-FOR-US: Silicon Labs
 CVE-2026-63243 (An authentication vulnerability in the Bluetooth Low Energy (BLE) impl ...)
-	TODO: check
+	NOT-FOR-US: Creative Sound Blaster Katana
 CVE-2026-61791 (OCO-Server is a self-hosted endpoint management application for comput ...)
-	TODO: check
+	NOT-FOR-US: OCO-Server
 CVE-2026-59188 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-55981 (A firmware verification vulnerability in Creative Sound Blaster Katana ...)
-	TODO: check
+	NOT-FOR-US: Creative Sound Blaster Katana
 CVE-2026-55835 (Lookyloo is a web interface that allows users to capture a website pag ...)
-	TODO: check
+	NOT-FOR-US: Lookyloo
 CVE-2026-55600 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-54631 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-54630 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-54615 (Part-DB is an open source inventory management system for electronic c ...)
-	TODO: check
+	NOT-FOR-US: Part-DB
 CVE-2026-54532 (CloudPirates Open Source Helm Charts is a collection of Helm charts. P ...)
-	TODO: check
+	NOT-FOR-US: CloudPirates Open Source Helm Charts
 CVE-2026-54238 (Supabase Realtime provides Broadcast, Presence, and Postgres Changes v ...)
-	TODO: check
+	NOT-FOR-US: Supabase Realtime
 CVE-2026-51954 (An issue in Webasyst Framework 4.0.3 and before allows a remote attack ...)
-	TODO: check
+	NOT-FOR-US: Webasyst Framework
 CVE-2026-21812 (HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmissio ...)
 	NOT-FOR-US: HCL
 CVE-2026-21811 (HCL AppScan Azure Boards Plugin is potentially affected by an Informat ...)
 	NOT-FOR-US: HCL
 CVE-2026-19678 (A server-side request forgery (SSRF) vulnerability in the unauthentica ...)
-	TODO: check
+	NOT-FOR-US: onPhase
 CVE-2026-19677 (An authentication bypass vulnerability in the public onPhase/ frevvo r ...)
-	TODO: check
+	NOT-FOR-US: onPhase
 CVE-2026-16477 (CleanShot X for macOS insecurely deserializes untrusted data embedded  ...)
-	TODO: check
+	NOT-FOR-US: CleanShot X for macOS
 CVE-2026-13599 (Missing authentication for critical function vulnerability in ABB Abil ...)
 	NOT-FOR-US: ABB group
 CVE-2026-13411 (Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements w ...)
@@ -260,27 +260,27 @@ CVE-2026-115547 (An input validation issue in the Okta Access Gateway (OAG) Admi
 CVE-2026-115546 (Okta Access Gateway (OAG) does not validate the selected authenticatio ...)
 	NOT-FOR-US: Okta
 CVE-2026-115537 (A weakness has been identified in gedelumbung HospitalManagement up to ...)
-	TODO: check
+	NOT-FOR-US: gedelumbung HospitalManagement
 CVE-2026-115536 (A security flaw has been discovered in gedelumbung HospitalManagement  ...)
-	TODO: check
+	NOT-FOR-US: gedelumbung HospitalManagement
 CVE-2026-115535 (A vulnerability was identified in gedelumbung HospitalManagement up to ...)
-	TODO: check
+	NOT-FOR-US: gedelumbung HospitalManagement
 CVE-2026-115534 (A vulnerability was determined in gedelumbung HospitalManagement up to ...)
-	TODO: check
+	NOT-FOR-US: gedelumbung HospitalManagement
 CVE-2026-115519 (Missing security attributes on sensitive cookies in KNIME Business Hub ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115517 (Unrestricted network access between execution contexts in KNIME Busine ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115516
 	REJECTED
 CVE-2026-115513 (OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerab ...)
-	TODO: check
+	NOT-FOR-US: OpenCATS
 CVE-2026-115509 (Jitsu console before 2.14.0-beta.41 contains an incorrect authorizatio ...)
-	TODO: check
+	NOT-FOR-US: Jitsu
 CVE-2026-115508 (Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-115507 (Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-115506 (libexpat through 2.9.0 contains a denial of service vulnerability beca ...)
 	TODO: check
 CVE-2026-115505 (libsmb2 before 6.3 contains integer overflow vulnerabilities in the DC ...)
@@ -290,13 +290,13 @@ CVE-2026-115504 (CFITSIO through 4.7.0 contains an out-of-bounds write vulnerabi
 CVE-2026-115503 (Ghidra before 12.2 contains an improper handling of highly compressed  ...)
 	- ghidra <itp> (bug #923851)
 CVE-2026-115502 (A missing authorization check allows anyone having access to a "link w ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115497 (The Music Store \u2013 WordPress eCommerce plugin for WordPress is vul ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-115496 (Overly informative error messages in the catalog functionality of KNIM ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115494 (A flaw in the cross-site request forgery (CSRF) prevention of KNIME Bu ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115486 (A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Nei ...)
 	TODO: check
 CVE-2026-115485 (A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 o ...)
@@ -306,7 +306,7 @@ CVE-2026-115484 (A flaw was found in the iscsiuio component of open-iscsi. The D
 CVE-2026-115482 (In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive ...)
 	TODO: check
 CVE-2026-115454 (An excessive resource allocation issue in the remote workflow editing  ...)
-	TODO: check
+	NOT-FOR-US: KNIME Business Hub
 CVE-2026-115453 (Authorization Bypass Through User-Controlled Key (CWE-639) in the cart ...)
 	TODO: check
 CVE-2026-115450 (External Control of Assumed-Immutable Web Parameter (CWE-472) in the c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7570d6d829f88dfe2052da689ba229c6804ab046

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7570d6d829f88dfe2052da689ba229c6804ab046
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/7135093e/attachment.htm>

More information about the debian-security-tracker-commits mailing list