[Git][security-tracker-team/security-tracker][master] Process new NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 24 13:19:20 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2e78693f by Salvatore Bonaccorso at 2026-10-24T14:18:55+02:00
Process new NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -323,33 +323,33 @@ CVE-2026-115754 (serialize-javascript from 7.0.1 before 7.1.3 contains a cross-s
NOTE: https://github.com/yahoo/serialize-javascript/pull/235
NOTE: Fixed by: https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 (v7.1.3)
CVE-2026-115752 (Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-sid ...)
- TODO: check
+ NOT-FOR-US: Signal K Server
CVE-2026-115751 (Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server- ...)
- TODO: check
+ NOT-FOR-US: Agentfront mcp-from-openapi
CVE-2026-115750 (mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposur ...)
- TODO: check
+ NOT-FOR-US: Agentfront mcp-from-openapi
CVE-2026-115749 (hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0 ...)
- TODO: check
+ NOT-FOR-US: hydra-ray-launcher
CVE-2026-115730 (i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUr ...)
TODO: check
CVE-2026-115729 (@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request ...)
- TODO: check
+ NOT-FOR-US: pdfme/common
CVE-2026-115728 (@hapi/content from 6.0.1 before 6.0.3 contains a regular expression de ...)
- TODO: check
+ NOT-FOR-US: hapi/content
CVE-2026-115727 (AgenticSeek before commit 409840c contains a remote code execution vul ...)
- TODO: check
+ NOT-FOR-US: AgenticSeek
CVE-2026-115726 (Aider through 0.86.2 contains a command execution vulnerability that a ...)
- TODO: check
+ NOT-FOR-US: Aider
CVE-2026-115725 (Chatwoot before 4.17.0 contains an authorization bypass vulnerability ...)
- TODO: check
+ NOT-FOR-US: Chatwoot
CVE-2026-115724 (VLC for Android before 3.7.2 contains a confused-deputy file overwrite ...)
- TODO: check
+ NOT-FOR-US: VLC Android (separate project of src:vlc)
CVE-2026-115723 (Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: Snap7
CVE-2026-115722 (RPly through 1.1.4 contains an improper array index validation vulnera ...)
TODO: check
CVE-2026-115657 (When used as an executor in either KNIME Server or KNIME Business Hub, ...)
- TODO: check
+ NOT-FOR-US: KNIME
CVE-2026-115586 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc
@@ -376,41 +376,41 @@ CVE-2026-115572 (pypdf is a free and open-source pure-python PDF library. Prior
CVE-2026-115570 (Electron is a framework for writing cross-platform desktop application ...)
TODO: check
CVE-2026-115569 (Fallow is a codebase intelligence tool for TypeScript and JavaScript. ...)
- TODO: check
+ NOT-FOR-US: Fallow
CVE-2026-115567 (Tokio is a runtime for writing applications with Rust. In 1.54.0, a ra ...)
TODO: check
CVE-2026-115481 (baserCMS is a website development framework. Starting in version 5.0.0 ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-115480 (baserCMS is a website development framework. In versions 5.0.0 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-115479 (baserCMS is a website development framework. In versions 5.2.5 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-115478 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-115477 (obsidian-tc is a governed, agent-ready Model Context Protocol server f ...)
- TODO: check
+ NOT-FOR-US: obsidian-tc
CVE-2026-115457 (baserCMS is a website development framework. In versions 5.0.0 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-114624 (baserCMS is a website development framework. In versions 5.0.0 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-114623 (baserCMS is a website development framework. In versions 5.0.0 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-114622 (baserCMS is a website development framework. In versions 5.2.3 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-114621 (baserCMS is a website development framework. In versions 5.0.0 before ...)
- TODO: check
+ NOT-FOR-US: baserCMS
CVE-2026-114429 (The WPVR WordPress plugin before 9.0.3 does not properly sanitise and ...)
NOT-FOR-US: WordPress plugin
CVE-2026-114357 (Missing authentication for a critical function in the Android Debug Br ...)
- TODO: check
+ NOT-FOR-US: DJI CrystalSky ZS600C firmware
CVE-2026-114356 (Missing authorization in the system-privileged 'DJIUpdateService' bind ...)
- TODO: check
+ NOT-FOR-US: DJI CrystalSky ZS600C firmware
CVE-2026-114355 (OS command injection in the root-privileged 'hardware_monitor' helper ...)
- TODO: check
+ NOT-FOR-US: DJI CrystalSky ZS600C firmware
CVE-2026-114354 (Missing authorization in the native binder service 'android.dji.server ...)
- TODO: check
+ NOT-FOR-US: DJI CrystalSky ZS600C firmware
CVE-2026-114353 (Hidden functionality (undocumented backdoor) in the root-privileged 'a ...)
- TODO: check
+ NOT-FOR-US: DJI CrystalSky ZS600C firmware
CVE-2026-113951 (If an attacker can write to the filesystem of a container k8s cluster ...)
NOT-FOR-US: Apple
CVE-2026-113877 (HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exha ...)
@@ -432,7 +432,7 @@ CVE-2026-113490 (The GeoDirectory WordPress plugin before 2.8.194 does not perf
CVE-2026-113489 (The GeoDirectory WordPress plugin before 2.8.194 does not verify that ...)
NOT-FOR-US: WordPress plugin
CVE-2026-112904 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
- TODO: check
+ NOT-FOR-US: Vvveb
CVE-2026-112863 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112862 (Deserialization of Untrusted Data vulnerability in xnau webdesign Part ...)
@@ -480,15 +480,15 @@ CVE-2026-112821 (Missing Authorization vulnerability in Knit Pay Knit Pay knit-p
CVE-2026-112359 (Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappnin ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112342 (Tandoor Recipes before 2.7.0 contains an improper cache-key design in ...)
- TODO: check
+ NOT-FOR-US: Tandoor Recipes
CVE-2026-112333 (GFI Archiver before 15.14 contains a stored cross-site scripting vulne ...)
- TODO: check
+ NOT-FOR-US: GFI Archiver
CVE-2026-112207 (The Download Monitor WordPress plugin before 5.3.4 does not properly v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-111965 (The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enfo ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110975 (A flaw was found in Kruize Autotune. Its REST API ships without an aut ...)
- TODO: check
+ NOT-FOR-US: Kruize Autotune
CVE-2026-110956 (The asVereinbase WordPress plugin before 1.1.8 does not require a val ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110814
@@ -2271,7 +2271,7 @@ CVE-2026-111181 (body-parser is body parsing middleware for Node.js and Express.
CVE-2026-111100 (The ONVIF device service on the E3 responds to certain informational r ...)
NOT-FOR-US: E3
CVE-2026-111079 (A flaw was found in Goose. When the terminal integration feature is en ...)
- TODO: check
+ NOT-FOR-US: Goose
CVE-2026-110974 (The org.json parser in com.vaadin.external.google:android-json recurse ...)
NOT-FOR-US: Vaadin
CVE-2026-110894 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
@@ -8156,7 +8156,7 @@ CVE-2026-113359 (Baserow before 2.3.0 contains a missing authorization vulnerabi
CVE-2026-113358 (LavaLite CMS through 10.1.2 contains a missing authentication vulnerab ...)
NOT-FOR-US: LavaLite CMS
CVE-2026-113357 (@e2e-dev/github before 0.4.1 contains an improper authorization vulner ...)
- TODO: check
+ NOT-FOR-US: e2e-dev/github
CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection vulnerabil ...)
- dokuwiki 2026-07-14.c+dfsg-1
NOTE: https://github.com/dokuwiki/dokuwiki/issues/4752
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e78693febe7163b341e0ad90cbba771d86c019e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e78693febe7163b341e0ad90cbba771d86c019e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/591e3a0c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list