[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c5d591a6 by Salvatore Bonaccorso at 2026-10-24T12:33:34+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -223,9 +223,9 @@ CVE-2026-39902 (Cacti is an open source performance and fault management framewo
 	NOTE: https://github.com/Cacti/cacti/security/advisories/GHSA-c4qp-j9r9-fq24
 	NOTE: https://github.com/Cacti/cacti/pull/7112
 CVE-2026-25784 (Initialization of a Resource with an Insecure Default vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: Hallo Welt! GmbH BlueSpice (container image bluespice/wiki)
 CVE-2026-25716 (Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Ext ...)
-	TODO: check
+	NOT-FOR-US: Hallo Welt! GmbH BlueSpice
 CVE-2026-19741 (Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD  ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-16762 (An attacker able to supply a crafted XML document to an application us ...)
@@ -233,25 +233,25 @@ CVE-2026-16762 (An attacker able to supply a crafted XML document to an applicat
 CVE-2026-115938 (Craft CMS allows any authenticated control panel user to submit an ele ...)
 	NOT-FOR-US: Craft CMS or plugin for Craft CMS
 CVE-2026-115937 (The Mollie webhook endpoint accepts two independent, attacker-controll ...)
-	TODO: check
+	NOT-FOR-US: Craft CMS Mollie webhook
 CVE-2026-115935 (Theapp/process-api-response-headersaction accepts fake Craft API respo ...)
-	TODO: check
+	NOT-FOR-US: Craft CMS
 CVE-2026-115931 (Postiz lets a signed-in user ask the backend to run a function on one  ...)
-	TODO: check
+	NOT-FOR-US: Postiz
 CVE-2026-115929 (MongoDB Compass relies on Electron, a third-party runtime that carries ...)
-	TODO: check
+	NOT-FOR-US: MongoDB Compass
 CVE-2026-115897 (Serialize JavaScript serializes JavaScript values to a superset of JSO ...)
-	TODO: check
+	NOT-FOR-US: MongoDB Compass
 CVE-2026-115895 (Happy DOM is a JavaScript implementation of a web browser without its  ...)
-	TODO: check
+	NOT-FOR-US: Happy DOM
 CVE-2026-115887 (GraphQL Scalars is a library of custom GraphQL scalars for creating pr ...)
-	TODO: check
+	NOT-FOR-US: GraphQL Scalars
 CVE-2026-115886 (MLflow is an open source AI engineering platform for agents, large lan ...)
 	NOT-FOR-US: mlflow
 CVE-2026-115885 (The LangGraph CLI is the official command-line interface for LangGraph ...)
-	TODO: check
+	NOT-FOR-US: LangGraph CLI
 CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and SQLite-backed state  ...)
-	TODO: check
+	NOT-FOR-US: LangGraph
 CVE-2026-115877 (Twisted is an event-based framework for internet applications, support ...)
 	TODO: check
 CVE-2026-115863 (ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Rep ...)
@@ -263,19 +263,19 @@ CVE-2026-115813 (Server-side request forgery in the model download path in Amazo
 CVE-2026-115812 (Relative path traversal during model archive extraction in Amazon Web  ...)
 	NOT-FOR-US: Amazon
 CVE-2026-115810 (Tandoor Recipes before 2.7.0 contains a server-side request forgery vu ...)
-	TODO: check
+	NOT-FOR-US: Tandoor Recipes
 CVE-2026-115807 (The User Profile Builder \u2013 Beautiful User Registration Forms, Use ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-115806 (The Prime Mover \u2013 Backup and Migration plugin for WordPress is vu ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-115803 (A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: Scada-LTS
 CVE-2026-115802 (A weakness has been identified in InternScience InternAgent 1.5.0. Thi ...)
-	TODO: check
+	NOT-FOR-US: InternScience InternAgent
 CVE-2026-115801 (A security flaw has been discovered in Kakao khaiii up to 0.4. The imp ...)
-	TODO: check
+	NOT-FOR-US: Kakao khaiii
 CVE-2026-115800 (A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. ...)
-	TODO: check
+	NOT-FOR-US: UbiquitousLearning mllm
 CVE-2026-115797 (A weakness has been identified in Tenda F6 12.02.01.73. Affected is an ...)
 	NOT-FOR-US: Tenda
 CVE-2026-115796 (A security flaw has been discovered in Tenda F6 12.02.01.73. This impa ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5d591a61c8058c2a6284a12f121a8887121b28e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5d591a61c8058c2a6284a12f121a8887121b28e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/fd233d31/attachment.htm>