[Git][security-tracker-team/security-tracker][master] Process more NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 23 20:09:22 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d5b593ec by Salvatore Bonaccorso at 2026-10-23T21:08:47+02:00
Process more NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1563,11 +1563,11 @@ CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries
 	NOTE: https://github.com/python/cpython/pull/160341 (3.13)
 	NOTE: https://github.com/python/cpython/pull/160343 (3.11)
 CVE-2026-114519 (Missing Authorization (CWE-862) in the user API of Roskus Prospero Flo ...)
-	TODO: check
+	NOT-FOR-US: Roskus Prospero Flow CRM
 CVE-2026-114515 (OCO-Server is a self-hosted endpoint management application for comput ...)
-	TODO: check
+	NOT-FOR-US: OCO-Server
 CVE-2026-114510 (Flexible GraphRAG is a Python framework for building graph and retriev ...)
-	TODO: check
+	NOT-FOR-US: Flexible GraphRAG
 CVE-2026-114487 (Missing authorization in the PAM AD computer import endpoint in Devolu ...)
 	NOT-FOR-US: Devolutions
 CVE-2026-114486 (Incorrect authorization in the Devolutions Gateway token generation in ...)
@@ -1575,17 +1575,17 @@ CVE-2026-114486 (Incorrect authorization in the Devolutions Gateway token genera
 CVE-2026-114485 (Insufficient protection of sensitive information in the user list endp ...)
 	NOT-FOR-US: Devolutions
 CVE-2026-114348 (webpack-dev-server is a development server that provides live reloadin ...)
-	TODO: check
+	NOT-FOR-US: Node webpack-dev-server
 CVE-2026-114195 (Insertion of Sensitive Information into Externally-Accessible File or  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-113876 (SmileCDR HAPI FHIR does not correctly check authorization for conditio ...)
-	TODO: check
+	NOT-FOR-US: SmileCDR
 CVE-2026-113875 (On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, i ...)
-	TODO: check
+	NOT-FOR-US: SmileCDR
 CVE-2026-113874 (SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partit ...)
-	TODO: check
+	NOT-FOR-US: SmileCDR
 CVE-2026-113873 (SmileCDR HAPI FHIR does not properly handle highly compressed data, al ...)
-	TODO: check
+	NOT-FOR-US: SmileCDR
 CVE-2026-113872 (multer is a middleware for Node.js that handles multipart/form-data fi ...)
 	NOT-FOR-US: Node multer
 CVE-2026-113582 (UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity  ...)
@@ -1611,11 +1611,11 @@ CVE-2026-112820 (Improper Control of Filename for Include/Require Statement in P
 CVE-2026-112379 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112332 (Motor.NET before 0.19.0 contains an uncaught exception vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: Motor.NET
 CVE-2026-112331 (Motor.NET before 0.19.0 contains a denial-of-service vulnerability tha ...)
-	TODO: check
+	NOT-FOR-US: Motor.NET
 CVE-2026-112330 (Motor.NET before 0.19.0 contains a denial of service vulnerability tha ...)
-	TODO: check
+	NOT-FOR-US: Motor.NET
 CVE-2026-112327 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112313 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -1635,7 +1635,7 @@ CVE-2026-112219 (The Download Monitor WordPress plugin before 5.3.5 does not cor
 CVE-2026-112218 (Missing Authorization vulnerability in Ahmad Majestic Support majestic ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-112085 (webpack-dev-server is a development server that provides live reloadin ...)
-	TODO: check
+	NOT-FOR-US: Node webpack-dev-server
 CVE-2026-111982 (The User Profile Builder  WordPress plugin before 4.0.5 does not verif ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-111966 (The User Profile Builder  WordPress plugin before 4.0.5 does not sanit ...)
@@ -1651,11 +1651,11 @@ CVE-2026-111738 (The Speed Optimizer  WordPress plugin before 7.8.5 does not ver
 CVE-2026-111737 (The Speed Optimizer  WordPress plugin before 7.8.5 does not sanitise o ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-111594 (InterSystems IRIS for Health has TLS/SSL encryption turned off by defa ...)
-	TODO: check
+	NOT-FOR-US: InterSystems IRIS
 CVE-2026-111181 (body-parser is body parsing middleware for Node.js and Express. In ver ...)
 	TODO: check
 CVE-2026-111100 (The ONVIF device service on the E3 responds to certain informational r ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-111079 (A flaw was found in Goose. When the terminal integration feature is en ...)
 	TODO: check
 CVE-2026-110974 (The org.json parser in com.vaadin.external.google:android-json recurse ...)
@@ -1665,15 +1665,15 @@ CVE-2026-110894 (Missing Authorization vulnerability in Brainstorm Force SureDas
 CVE-2026-110893 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-110825 (The ONVIF device service on affected Kiloview E3 NDI encoder firmware  ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-110537 (The Essential Addons for Elementor  WordPress plugin before 6.8.7 does ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-110510 (The Essential Addons for Elementor  WordPress plugin before 6.8.7 does ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-110491 (The ONVIF service on the E3 can be rendered unresponsive by sending ma ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-110243 (The network management service on affected Kiloview E3 NDI encoder fir ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-110063 (Improper link resolution before file access ('link following') in VM I ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-109936 (The Otter Blocks  WordPress plugin before 3.2.8 does not correctly bou ...)
@@ -1687,19 +1687,19 @@ CVE-2026-109933 (The Otter Blocks  WordPress plugin before 3.2.8 does not proper
 CVE-2026-109198 (The Anti-Spam by CleanTalk \u2013 Spam Protection Without CAPTCHA plug ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-109122 (The network management service on affected Kiloview E3 NDI encoder fir ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-108456 (Server-side request forgery (ssrf) in Azure AI Foundry allows an autho ...)
 	NOT-FOR-US: Microsoft
 CVE-2026-108360 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
-	TODO: check
+	NOT-FOR-US: PhpSpreadsheet
 CVE-2026-108359 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
-	TODO: check
+	NOT-FOR-US: PhpSpreadsheet
 CVE-2026-108358 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
-	TODO: check
+	NOT-FOR-US: PhpSpreadsheet
 CVE-2026-108357 (PhpSpreadsheet is a pure PHP library for reading and writing spreadshe ...)
-	TODO: check
+	NOT-FOR-US: PhpSpreadsheet
 CVE-2026-107861 (The system control service on affected Kiloview E3 NDI encoder firmwar ...)
-	TODO: check
+	NOT-FOR-US: E3
 CVE-2026-107858 (Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cros ...)
 	TODO: check
 CVE-2026-107079 (An issue in Systrome Validation & Certification 1.0 allows an attacker ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5b593eceb918245b11da0993d09ca8124efeee8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5b593eceb918245b11da0993d09ca8124efeee8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/32b3c377/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list