[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 24 08:14:25 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fc94c7fa by security tracker role at 2026-10-24T07:14:17+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,35 +1,35 @@
CVE-2026-97353 (The News Kit Addons For Elementor WordPress plugin through 1.4.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97352 (The News Kit Addons For Elementor WordPress plugin before 1.4.9 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-95620 (A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 ...)
TODO: check
CVE-2026-94263 (The Advanced Custom Fields: Extended and Advanced Custom Fields: Exten ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93640 (A local privilege escalation vulnerability in the optional dnscache pa ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93639 (A missing authorization vulnerability in Zimbra Collaboration Suite (Z ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93638 (A reflected cross-site scripting vulnerability in the login page of Zi ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93636 (An LDAP filter injection vulnerability in Zimbra Collaboration Suite ( ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93634 (A cross-account authorization vulnerability in Zimbra Collaboration Su ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93633 (A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) a ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93631 (A cross-site request forgery vulnerability in the OAuth extension of Z ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93630 (A hostname canonicalization vulnerability in the email HTML sanitizers ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93629 (An organizer authentication vulnerability in Zimbra Collaboration Suit ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93628 (An attendee authentication vulnerability in the email calendar process ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93627 (An organizer authentication vulnerability in the email calendar proces ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-93489 (Improper Authentication in ASUS router modules allows an unauthenticat ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-91093 (A potential security vulnerability has been identified in HP One Agent ...)
TODO: check
CVE-2026-89320 (`HmacShaCryptor.Hash` never hashed its input. For any input it returne ...)
@@ -53,25 +53,25 @@ CVE-2026-89312 (`AesGcmCryptor.Open` passed a caller-supplied nonce straight to
CVE-2026-87901 (Improper sanitization in the registration module allows reflected Cros ...)
TODO: check
CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not restrict ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-83813 (Twisted is an event-based framework for internet applications, support ...)
TODO: check
CVE-2026-79982 (The Bluetooth HCI USB transport class of the new USB device stack, sub ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79981 (The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP so ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79980 (The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its tra ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79979 (The arm64 MMU backend invalidates a single virtual address from the TL ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79978 (The RTIO streaming completion callback adxl345_process_fifo_samples_cb ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-79977 (The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-75779 (Improper Neutralization of Special Elements used in an OS Command (\u2 ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75775 (Improper Neutralization of Special Elements used in an OS Command in c ...)
- TODO: check
+ NOT-FOR-US: ASUS
CVE-2026-75525 (OpenReception's appointment booking software provides an end-to-end en ...)
TODO: check
CVE-2026-75524 (OpenReception's appointment booking software provides an end-to-end en ...)
@@ -101,37 +101,37 @@ CVE-2026-57208 (Entire CLI hooks into Git workflows to capture AI agent sessions
CVE-2026-57207 (NetBox MCP Server is a simple read-only Model Context Protocol server ...)
TODO: check
CVE-2026-57146 (PraisonAI is a multi-agent teams system. From version 4.5.115 to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57144 (PraisonAI is a multi-agent teams system. From version 4.5.110 to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57142 (PraisonAI is a multi-agent teams system. From version 4.5.87 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57121 (PraisonAI is a multi-agent teams system. From version 0.1.4 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57117 (PraisonAI is a multi-agent teams system. From version 4.6.10 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57116 (PraisonAI is a multi-agent teams system. From version 4.2.1 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57114 (PraisonAI is a multi-agent teams system. From version 4.5.126 to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-57113 (PraisonAI is a multi-agent teams system. From version 2.6.0 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56840 (PraisonAI is a multi-agent teams system. From version 4.5.2 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56838 (PraisonAI is a multi-agent teams system. From version 4.5.87 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56837 (PraisonAI is a multi-agent teams system. From version 4.6.56 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56836 (PraisonAI is a multi-agent teams system. From version 4.5.112 to befor ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56835 (PraisonAI is a multi-agent teams system. From version 3.11.0 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56834 (PraisonAI is a multi-agent teams system. From version 3.8.1 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56833 (PraisonAI is a multi-agent teams system. From version 3.8.1 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-56832 (PraisonAI is a multi-agent teams system. From version 4.5.2 to before ...)
- TODO: check
+ NOT-FOR-US: PraisonAI
CVE-2026-55889 (XDG Desktop Portal is a desktop integration portal. Prior to version 1 ...)
TODO: check
CVE-2026-55888 (XDG Desktop Portal is a desktop integration portal. Prior to version 1 ...)
@@ -173,15 +173,15 @@ CVE-2026-53920 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server us
CVE-2026-53918 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by ...)
TODO: check
CVE-2026-52356 (An OS command injection vulnerability in the /htdocs/web/diagnostic.ph ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-50787 (e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled re ...)
TODO: check
CVE-2026-50057 (A local privilege escalation vulnerability in the Zimbra Collaboration ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50056 (A local privilege escalation vulnerability in the zmmailboxdmgr launch ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50053 (A request attribute override vulnerability in Zimbra Collaboration Sui ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-4952 (The "ASMobile" web interface, which is part of the VertiGIS software p ...)
TODO: check
CVE-2026-4951 (The CustomerAdministration portal (KundenManager) of VertiGIS WebOrder ...)
@@ -207,11 +207,11 @@ CVE-2026-25784 (Initialization of a Resource with an Insecure Default vulnerabil
CVE-2026-25716 (Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Ext ...)
TODO: check
CVE-2026-19741 (Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-16762 (An attacker able to supply a crafted XML document to an application us ...)
TODO: check
CVE-2026-115938 (Craft CMS allows any authenticated control panel user to submit an ele ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-115937 (The Mollie webhook endpoint accepts two independent, attacker-controll ...)
TODO: check
CVE-2026-115935 (Theapp/process-api-response-headersaction accepts fake Craft API respo ...)
@@ -229,7 +229,7 @@ CVE-2026-115893 (Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7
CVE-2026-115887 (GraphQL Scalars is a library of custom GraphQL scalars for creating pr ...)
TODO: check
CVE-2026-115886 (MLflow is an open source AI engineering platform for agents, large lan ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-115885 (The LangGraph CLI is the official command-line interface for LangGraph ...)
TODO: check
CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and SQLite-backed state ...)
@@ -239,17 +239,17 @@ CVE-2026-115877 (Twisted is an event-based framework for internet applications,
CVE-2026-115863 (ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Rep ...)
TODO: check
CVE-2026-115845 (An incomplete list of disallowed inputs in the Python code validator o ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115813 (Server-side request forgery in the model download path in Amazon Web S ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115812 (Relative path traversal during model archive extraction in Amazon Web ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115810 (Tandoor Recipes before 2.7.0 contains a server-side request forgery vu ...)
TODO: check
CVE-2026-115807 (The User Profile Builder \u2013 Beautiful User Registration Forms, Use ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115806 (The Prime Mover \u2013 Backup and Migration plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115803 (A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerabili ...)
TODO: check
CVE-2026-115802 (A weakness has been identified in InternScience InternAgent 1.5.0. Thi ...)
@@ -259,13 +259,13 @@ CVE-2026-115801 (A security flaw has been discovered in Kakao khaiii up to 0.4.
CVE-2026-115800 (A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. ...)
TODO: check
CVE-2026-115797 (A weakness has been identified in Tenda F6 12.02.01.73. Affected is an ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-115796 (A security flaw has been discovered in Tenda F6 12.02.01.73. This impa ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-115786 (A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-115785 (An SMTP command injection vulnerability in the data-source testing fun ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-115778 (Twisted is an event-based framework for internet applications, support ...)
TODO: check
CVE-2026-115776 (Twisted is an event-based framework for internet applications, support ...)
@@ -339,7 +339,7 @@ CVE-2026-114622 (baserCMS is a website development framework. In versions 5.2.3
CVE-2026-114621 (baserCMS is a website development framework. In versions 5.0.0 before ...)
TODO: check
CVE-2026-114429 (The WPVR WordPress plugin before 9.0.3 does not properly sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114357 (Missing authentication for a critical function in the Android Debug Br ...)
TODO: check
CVE-2026-114356 (Missing authorization in the system-privileged 'DJIUpdateService' bind ...)
@@ -351,97 +351,97 @@ CVE-2026-114354 (Missing authorization in the native binder service 'android.dji
CVE-2026-114353 (Hidden functionality (undocumented backdoor) in the root-privileged 'a ...)
TODO: check
CVE-2026-113951 (If an attacker can write to the filesystem of a container k8s cluster ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-113877 (HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exha ...)
TODO: check
CVE-2026-113674 (The GeoDirectory WordPress plugin before 2.8.194 does not correctly v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113673 (The GeoDirectory WordPress plugin before 2.8.194 does not properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113493 (The GeoDirectory WordPress plugin before 2.8.194 does not sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113492 (The GeoDirectory WordPress plugin before 2.8.194 does not perform sta ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113491 (The GeoDirectory WordPress plugin before 2.8.194 does not validate a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113490 (The GeoDirectory WordPress plugin before 2.8.194 does not perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113489 (The GeoDirectory WordPress plugin before 2.8.194 does not verify that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112904 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
TODO: check
CVE-2026-112863 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112862 (Deserialization of Untrusted Data vulnerability in xnau webdesign Part ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112860 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112859 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Litt ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112858 (Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112857 (Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112856 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Vaga ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112855 (Deserialization of Untrusted Data vulnerability in axiomthemes Redy re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112854 (Deserialization of Untrusted Data vulnerability in axiomthemes Holisti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112853 (Deserialization of Untrusted Data vulnerability in axiomthemes Hallelu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112852 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Heli ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112851 (Deserialization of Untrusted Data vulnerability in ThemeREX Group HotL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112850 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112849 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112848 (Deserialization of Untrusted Data vulnerability in AivahThemes Hostme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112847 (Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul ze ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112846 (Deserialization of Untrusted Data vulnerability in ThemeREX Group Save ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112838 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112837 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112835 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112825 (Missing Authorization vulnerability in Magepeople inc. Car Rental Mana ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112821 (Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112359 (Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappnin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112342 (Tandoor Recipes before 2.7.0 contains an improper cache-key design in ...)
TODO: check
CVE-2026-112333 (GFI Archiver before 15.14 contains a stored cross-site scripting vulne ...)
TODO: check
CVE-2026-112207 (The Download Monitor WordPress plugin before 5.3.4 does not properly v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111965 (The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enfo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110975 (A flaw was found in Kruize Autotune. Its REST API ships without an aut ...)
TODO: check
CVE-2026-110956 (The asVereinbase WordPress plugin before 1.1.8 does not require a val ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110814
REJECTED
CVE-2026-10632 (A reflected cross-site scripting vulnerability in the Classic Web Clie ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-108793
REJECTED
CVE-2026-108537
REJECTED
CVE-2026-108013 (BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of ...)
- TODO: check
+ NOT-FOR-US: HCL
CVE-2026-107907 (The MAS Videos WordPress plugin through 1.3.4 does not perform any cap ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107887 (The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107685 (Improper Certificate Validation vulnerability in the WebSocket streami ...)
TODO: check
CVE-2026-106765 (An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to ...)
@@ -453,9 +453,9 @@ CVE-2026-106763 (An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a rem
CVE-2026-105963 (Externally-Generated Error Message Containing Sensitive Information vu ...)
TODO: check
CVE-2026-105199 (The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102786 (Joomla Extension - phoca.cz - Authenticated stored cross-site scriptin ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2025-58403 (CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due ...)
TODO: check
CVE-2025-45528 (An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc94c7fa43399966247a9d4b12af40c7648ba458
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fc94c7fa43399966247a9d4b12af40c7648ba458
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/040f3dbd/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list