[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 23 20:47:37 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c535d540 by Salvatore Bonaccorso at 2026-10-23T21:47:15+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1594,7 +1594,7 @@ CVE-2026-113873 (SmileCDR HAPI FHIR does not properly handle highly compressed d
 CVE-2026-113872 (multer is a middleware for Node.js that handles multipart/form-data fi ...)
 	NOT-FOR-US: Node multer
 CVE-2026-113582 (UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity  ...)
-	TODO: check
+	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-113501 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a c ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-113500 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one o ...)
@@ -7414,9 +7414,9 @@ CVE-2026-113619 (In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST,
 CVE-2026-113613 (FlexGet before 3.20.7 contains a path traversal vulnerability in the d ...)
 	TODO: check
 CVE-2026-113612 (SparkyFitness before 0.17.0 contains a missing authorization vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: SparkyFitness
 CVE-2026-113611 (Outline before 1.8.0 contains an improper access revocation vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Outline
 CVE-2026-113610 (Xen Orchestra before 6.9.0 contains an authorization bypass vulnerabil ...)
 	NOT-FOR-US: Xen Orchestra
 CVE-2026-113609 (Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to e ...)
@@ -7439,17 +7439,17 @@ CVE-2026-113602 (json-smart through 2.6.0 contains an input validation bypass vu
 	[bookworm] - json-smart <postponed> (Minor issue; can be fixed in next update)
 	NOTE: https://github.com/netplex/json-smart-v2/issues/302
 CVE-2026-113601 (Memos before 0.27.0 contains a missing authorization vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: Memos
 CVE-2026-113600 (Fat Free CRM before 0.26.0 contains an insecure direct object referenc ...)
-	TODO: check
+	NOT-FOR-US: Fat Free CRM
 CVE-2026-113599 (Modoboa before 2.8.0 contains an insecure direct object reference vuln ...)
-	TODO: check
+	NOT-FOR-US: Modoboa
 CVE-2026-113598 (Modoboa before 2.8.0 contains an insecure direct object reference vuln ...)
-	TODO: check
+	NOT-FOR-US: Modoboa
 CVE-2026-113597 (Blinko through 1.8.8 contains an insecure direct object reference vuln ...)
-	TODO: check
+	NOT-FOR-US: Blinko
 CVE-2026-113596 (Webstudio before 0.256.0 contains a missing authorization vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: Webstudio
 CVE-2026-113595 (Sharkord before 0.0.26 contains a missing authorization vulnerability  ...)
 	NOT-FOR-US: Sharkord
 CVE-2026-113594 (Sharkord before 0.0.8 contains a missing authorization vulnerability t ...)
@@ -7475,13 +7475,13 @@ CVE-2026-113468 (The payment notification endpoint for PayPal accepts incoming d
 CVE-2026-113466 (A security vulnerability has been detected in MinIO up to RELEASE.2025 ...)
 	TODO: check
 CVE-2026-113465 (It is possible to execute a DOM-based Cross-Site Scripting attack agai ...)
-	TODO: check
+	NOT-FOR-US: Stormshield
 CVE-2026-113459 (In versions running on TYPO3 10 and 11, the configured OpenAI API key  ...)
 	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-113442 (Values entered by visitors were placed into the HTML summary email wit ...)
 	NOT-FOR-US: TYPO3 (core or extensions)
 CVE-2026-113411 (A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by ...)
-	TODO: check
+	NOT-FOR-US: Nerimity Desktop
 CVE-2026-113407 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
 	NOT-FOR-US: BA-Workflow
 CVE-2026-113406 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
@@ -7489,7 +7489,7 @@ CVE-2026-113406 (BA-Workflow developed by YS-infoware has a SQL Injection vulner
 CVE-2026-113405 (BA-Workflow developed by YS-infoware has a SQL Injection vulnerability ...)
 	NOT-FOR-US: BA-Workflow
 CVE-2026-113403 (ArmorX Spam developed by ArmorX Global Technology has a Command Inject ...)
-	TODO: check
+	NOT-FOR-US: ArmorX
 CVE-2026-113397 (A security vulnerability has been detected in DrayTek Vigor2960 1.5.1. ...)
 	NOT-FOR-US: DrayTek Vigor2960
 CVE-2026-113396 (A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8 ...)
@@ -7509,23 +7509,23 @@ CVE-2026-113390 (A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 821
 CVE-2026-113389 (A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 821 ...)
 	NOT-FOR-US: DrayTek Vigor2960
 CVE-2026-113388 (A security flaw has been discovered in opensource-socialnetwork up to  ...)
-	TODO: check
+	NOT-FOR-US: pensource-socialnetwork
 CVE-2026-113385 (A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0. ...)
-	TODO: check
+	NOT-FOR-US: LeeDrOiD Labs Shortcutter 2 App
 CVE-2026-113384 (A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Optimal IdM OptimalCloud
 CVE-2026-113383 (A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This aff ...)
-	TODO: check
+	NOT-FOR-US: Optimal IdM OptimalCloud
 CVE-2026-113382 (A security vulnerability has been detected in arizu-id fast-tunnel 1.0 ...)
-	TODO: check
+	NOT-FOR-US: arizu-id fast-tunnel
 CVE-2026-113381 (A weakness has been identified in Osclass up to 8.3.1. Affected by thi ...)
-	TODO: check
+	NOT-FOR-US: Osclass
 CVE-2026-113378 (A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4. ...)
-	TODO: check
+	NOT-FOR-US: mcollina mcp-ripgrep
 CVE-2026-113359 (Baserow before 2.3.0 contains a missing authorization vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: Baserow
 CVE-2026-113358 (LavaLite CMS through 10.1.2 contains a missing authentication vulnerab ...)
-	TODO: check
+	NOT-FOR-US: LavaLite CMS
 CVE-2026-113357 (@e2e-dev/github before 0.4.1 contains an improper authorization vulner ...)
 	TODO: check
 CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection vulnerabil ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c535d54036027bcf909ade56cc806528d8ffcf1d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c535d54036027bcf909ade56cc806528d8ffcf1d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/3456c127/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list