[Git][security-tracker-team/security-tracker][master] Process some NFUs

Sat Oct 24 09:27:41 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c1a05da2 by Salvatore Bonaccorso at 2026-10-24T10:27:09+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -39,25 +39,25 @@ CVE-2026-93627 (An organizer authentication vulnerability in the email calendar
 CVE-2026-93489 (Improper Authentication in ASUS router modules allows an unauthenticat ...)
 	NOT-FOR-US: ASUS
 CVE-2026-91093 (A potential security vulnerability has been identified in HP One Agent ...)
-	TODO: check
+	NOT-FOR-US: HP
 CVE-2026-89320 (`HmacShaCryptor.Hash` never hashed its input. For any input it returne ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89319 (`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from  ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89318 (`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initializa ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89317 (gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89316 (`LoadPublicKey` resolved an EC key's curve with an unchecked type asse ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89315 (`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.Str ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89314 (`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89313 (`JwksTrustStore.Get` assigned each parsed key to the function's **name ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-89312 (`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `ciphe ...)
-	TODO: check
+	NOT-FOR-US: Eclipse
 CVE-2026-87901 (Improper sanitization in the registration module allows reflected Cros ...)
 	TODO: check
 CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not restrict  ...)
@@ -81,33 +81,33 @@ CVE-2026-75779 (Improper Neutralization of Special Elements used in an OS Comman
 CVE-2026-75775 (Improper Neutralization of Special Elements used in an OS Command in c ...)
 	NOT-FOR-US: ASUS
 CVE-2026-75525 (OpenReception's appointment booking software provides an end-to-end en ...)
-	TODO: check
+	NOT-FOR-US: OpenReception appointment booking software
 CVE-2026-75524 (OpenReception's appointment booking software provides an end-to-end en ...)
-	TODO: check
+	NOT-FOR-US: OpenReception appointment booking software
 CVE-2026-65825 (OpenReception's appointment booking software provides an end-to-end en ...)
-	TODO: check
+	NOT-FOR-US: OpenReception appointment booking software
 CVE-2026-65824 (OpenReception's appointment booking software provides an end-to-end en ...)
-	TODO: check
+	NOT-FOR-US: OpenReception appointment booking software
 CVE-2026-63244 (An authentication bypass vulnerability in WizLearn Technologies' Learn ...)
-	TODO: check
+	NOT-FOR-US: WizLearn Technologies Learning Management System (LMS)
 CVE-2026-63120 (pghoard is a PostgreSQL backup daemon and restore tooling that stores  ...)
-	TODO: check
+	NOT-FOR-US: pghoard
 CVE-2026-58497 (Uni-CLI gives people and agents one command interface for websites, br ...)
-	TODO: check
+	NOT-FOR-US: Uni-CLI
 CVE-2026-58202 (OpenReception's appointment booking software provides an end-to-end en ...)
-	TODO: check
+	NOT-FOR-US: OpenReception appointment booking software
 CVE-2026-57849
 	REJECTED
 CVE-2026-57845 (Hugging Face Datasets through 5.1.0 contains an insecure deserializati ...)
-	TODO: check
+	NOT-FOR-US: Hugging Face Datasets
 CVE-2026-57210 (Heimdall is a cloud native Identity Aware Proxy and Access Control Dec ...)
-	TODO: check
+	NOT-FOR-US: Heimdall
 CVE-2026-57209 (Heimdall is a cloud native Identity Aware Proxy and Access Control Dec ...)
-	TODO: check
+	NOT-FOR-US: Heimdall
 CVE-2026-57208 (Entire CLI hooks into Git workflows to capture AI agent sessions. Prio ...)
-	TODO: check
+	NOT-FOR-US: Entire CLI hooks
 CVE-2026-57207 (NetBox MCP Server is a simple read-only Model Context Protocol server  ...)
-	TODO: check
+	NOT-FOR-US: NetBox MCP Server
 CVE-2026-57146 (PraisonAI is a multi-agent teams system. From version 4.5.115 to befor ...)
 	NOT-FOR-US: PraisonAI
 CVE-2026-57144 (PraisonAI is a multi-agent teams system. From version 4.5.110 to befor ...)
@@ -145,7 +145,7 @@ CVE-2026-55889 (XDG Desktop Portal is a desktop integration portal. Prior to ver
 CVE-2026-55888 (XDG Desktop Portal is a desktop integration portal. Prior to version 1 ...)
 	TODO: check
 CVE-2026-55826 (The GTM Server Side plugin by stape.io implements server-side tracking ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-55606 (odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by  ...)
 	TODO: check
 CVE-2026-55486 (The Goobi viewer is a web application that allows digitised material t ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1a05da255a40b7c34f1d992c96de6a5b42310f2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1a05da255a40b7c34f1d992c96de6a5b42310f2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/d91bcbf2/attachment-0001.htm>
