[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 23 12:54:19 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
80f240d1 by Moritz Muehlenhoff at 2026-10-23T13:53:54+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -319,9 +319,9 @@ CVE-2026-115482 (In lsquic before 4.9.0, the HTTP/3 implementation can use an ex
CVE-2026-115454 (An excessive resource allocation issue in the remote workflow editing ...)
NOT-FOR-US: KNIME Business Hub
CVE-2026-115453 (Authorization Bypass Through User-Controlled Key (CWE-639) in the cart ...)
- TODO: check
+ NOT-FOR-US: Ecommerce Template
CVE-2026-115450 (External Control of Assumed-Immutable Web Parameter (CWE-472) in the c ...)
- TODO: check
+ NOT-FOR-US: Ecommerce Template
CVE-2026-115449 (A flaw was found in libslirp. When handling ICMP echo requests, the re ...)
- libslirp <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2558916
@@ -433,17 +433,17 @@ CVE-2026-115347 (Mistune before 3.3.0 contains an inefficient algorithmic comple
- mistune 3.3.4-1
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-f32h-38gf-rg5r
CVE-2026-115334 (Lotus through 0.10.2 contains an authorization bypass vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115333 (Lotus through 0.10.2 contains an improper authentication vulnerability ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115332 (Lotus through 0.10.2 contains an sql injection vulnerability that allo ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115331 (Lotus through 0.10.2 contains an sql injection vulnerability that allo ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115330 (Lotus through 0.10.2 contains an sql injection vulnerability that allo ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115329 (Lotus through 0.10.2 contains an insecure direct object reference vuln ...)
- TODO: check
+ NOT-FOR-US: Lotus
CVE-2026-115328 (JSON-SCADA before 0.65-alpha contains an sql injection vulnerability i ...)
TODO: check
CVE-2026-115327 (libyang through 6.4.13 contains an uninitialized pointer free vulnerab ...)
@@ -6418,9 +6418,9 @@ CVE-2026-113608 (Configurable Reports block for Moodle (moodle-block_configurabl
CVE-2026-113607 (Configurable Reports block for Moodle before 5.3.0 contains an authori ...)
NOT-FOR-US: Moodle plugin
CVE-2026-113606 (Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vuln ...)
- TODO: check
+ NOT-FOR-US: Stirling-PDF
CVE-2026-113605 (Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist ...)
- TODO: check
+ NOT-FOR-US: Stirling-PDF
CVE-2026-113604 (Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability ...)
- ghidra <itp> (bug #923851)
CVE-2026-113603 (The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28. ...)
@@ -6440,23 +6440,23 @@ CVE-2026-113597 (Blinko through 1.8.8 contains an insecure direct object referen
CVE-2026-113596 (Webstudio before 0.256.0 contains a missing authorization vulnerabilit ...)
TODO: check
CVE-2026-113595 (Sharkord before 0.0.26 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: Sharkord
CVE-2026-113594 (Sharkord before 0.0.8 contains a missing authorization vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Sharkord
CVE-2026-113583 (Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scr ...)
- TODO: check
+ NOT-FOR-US: Cypht webmail
CVE-2026-113507 (A vulnerability was found in aaPanel up to 8.25.0. The impacted elemen ...)
- TODO: check
+ NOT-FOR-US: aaPanel
CVE-2026-113506 (A vulnerability has been found in aaPanel up to 8.25.0. The affected e ...)
- TODO: check
+ NOT-FOR-US: aaPanel
CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is the functio ...)
- TODO: check
+ NOT-FOR-US: aaPanel
CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual Network Comp ...)
TODO: check
CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription Management ...)
TODO: check
CVE-2026-113469 (A failure has been identified in the SNS during dynamic data files sig ...)
- TODO: check
+ NOT-FOR-US: SNS
CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming data wit ...)
NOT-FOR-US: TYPO3 (core or extensions)
CVE-2026-113466 (A security vulnerability has been detected in MinIO up to RELEASE.2025 ...)
@@ -6470,31 +6470,31 @@ CVE-2026-113442 (Values entered by visitors were placed into the HTML summary em
CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by ...)
TODO: check
CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: BA-Workflow
CVE-2026-113406 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: BA-Workflow
CVE-2026-113405 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
- TODO: check
+ NOT-FOR-US: BA-Workflow
CVE-2026-113403 (ArmorX Spam developed by ArmorX Global Technology has a Command Inject ...)
TODO: check
CVE-2026-113397 (A security vulnerability has been detected in DrayTek Vigor2960 1.5.1. ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113396 (A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113395 (A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revis ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113394 (A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113393 (A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113392 (A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113391 (A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113390 (A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affe ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113389 (A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 821 ...)
- TODO: check
+ NOT-FOR-US: DrayTek Vigor2960
CVE-2026-113388 (A security flaw has been discovered in opensource-socialnetwork up to ...)
TODO: check
CVE-2026-113385 (A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0. ...)
@@ -6518,19 +6518,19 @@ CVE-2026-113357 (@e2e-dev/github before 0.4.1 contains an improper authorization
CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection vulnerabil ...)
TODO: check
CVE-2026-113355 (Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerab ...)
- TODO: check
+ NOT-FOR-US: Chatwoot
CVE-2026-113354 (Dockhand before 1.0.46 contains an arbitrary file read vulnerability t ...)
- TODO: check
+ NOT-FOR-US: Dockhand
CVE-2026-113353 (LearnPress before 4.4.10 contains a missing authorization vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: LearnPress
CVE-2026-113352 (uTox through 0.18.1 contains a path traversal vulnerability that allow ...)
TODO: check
CVE-2026-113351 (libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerabilit ...)
TODO: check
CVE-2026-113350 (react-admin before 5.15.5 contains a stored cross-site scripting vulne ...)
- TODO: check
+ NOT-FOR-US: react-admin
CVE-2026-113349 (OpenCATS before 0.10.0 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: OpenCATS
CVE-2026-112958 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
NOT-FOR-US: ApostropheCMS
CVE-2026-112957 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
@@ -6548,23 +6548,23 @@ CVE-2026-112952 (ApostropheCMS is an open-source Node.js content management syst
CVE-2026-112951 (ApostropheCMS is an open-source Node.js content management system. Pri ...)
NOT-FOR-US: ApostropheCMS
CVE-2026-112950 (Vitest is a Vite-native testing framework for JavaScript and TypeScrip ...)
- TODO: check
+ NOT-FOR-US: SNS
CVE-2026-112949 (Vitest is a Vite-native testing framework for JavaScript and TypeScrip ...)
- TODO: check
+ NOT-FOR-US: Vitest
CVE-2026-112948 (Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until ...)
- TODO: check
+ NOT-FOR-US: Vitest
CVE-2026-112947 (Vite is a frontend tooling framework for JavaScript. From 8.2.0 until ...)
- TODO: check
+ - node-vite <itp> (bug #1053782)
CVE-2026-112946 (Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7 ...)
- TODO: check
+ - node-vite <itp> (bug #1053782)
CVE-2026-112945 (Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7 ...)
- TODO: check
+ - node-vite <itp> (bug #1053782)
CVE-2026-112944 (launch-editor allows users to open files with line numbers in editor f ...)
- TODO: check
+ NOT-FOR-US: Node launch-editor
CVE-2026-112943 (launch-editor allows users to open files with line numbers in editor f ...)
- TODO: check
+ NOT-FOR-US: Node launch-editor
CVE-2026-112942 (launch-editor allows users to open files with line numbers in editor f ...)
- TODO: check
+ NOT-FOR-US: Node launch-editor
CVE-2026-112941 (filelock is a platform-independent file lock for Python. From 4.1.0 un ...)
- python-filelock <unfixed> (bug #1151686)
NOTE: https://github.com/tox-dev/filelock/security/advisories/GHSA-wfhq-q4j2-c37m
@@ -6687,21 +6687,21 @@ CVE-2026-111843 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-111767 (MCP TypeScript SDK is the official TypeScript SDK for Model Context Pr ...)
TODO: check
CVE-2026-111765 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
- TODO: check
+ NOT-FOR-US: A2A Java SDK
CVE-2026-111764 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
- TODO: check
+ NOT-FOR-US: A2A Java SDK
CVE-2026-111763 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
- TODO: check
+ NOT-FOR-US: A2A Java SDK
CVE-2026-111762 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
- TODO: check
+ NOT-FOR-US: A2A Java SDK
CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protoc ...)
- TODO: check
+ NOT-FOR-US: A2A Java SDK
CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
TODO: check
CVE-2026-111090 (A logic error exists in the signature verification routine resulting i ...)
- TODO: check
+ NOT-FOR-US: SNS
CVE-2026-111088 (A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log ...)
- TODO: check
+ NOT-FOR-US: SNS
CVE-2026-110725 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
TODO: check
CVE-2026-110306 (fast-uri is a dependency-free RFC 3986 URI parser and serializer for N ...)
@@ -6725,15 +6725,15 @@ CVE-2026-107755 (Insufficient filtering of credentials in the _replicator databa
CVE-2026-107597 (PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the ...)
NOT-FOR-US: Eclipse
CVE-2026-105949 (Cruise Control's Jetty ConstraintSecurityHandler registers security co ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-105941 (The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-105772 (Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScrip ...)
- TODO: check
+ NOT-FOR-US: Google ADK TypeScript
CVE-2026-105312 (A Kubernetes tenant with create permission on Console custom resources ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-105311 (The StreamsHub Console operator acts as a confused deputy: a Kubernete ...)
- TODO: check
+ NOT-FOR-US: Red Hat
CVE-2026-103119 (Buffer under-read vulnerability in Apache Tomcat meant that a large no ...)
- tomcat11 <unfixed>
NOTE: https://github.com/apache/tomcat/commit/f13748baa17a5e28925be455e0e2832e2032f58c (11.0.27)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80f240d10c7e9c0974c6cb33232fea74bef9146f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80f240d10c7e9c0974c6cb33232fea74bef9146f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/3cdfa120/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list