[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sat Oct 24 23:30:53 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ae0dbf43 by Moritz Muehlenhoff at 2026-10-25T00:30:22+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -624,13 +624,13 @@ CVE-2026-107907 (The MAS Videos WordPress plugin through 1.3.4 does not perform
CVE-2026-107887 (The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not ...)
NOT-FOR-US: WordPress plugin
CVE-2026-107685 (Improper Certificate Validation vulnerability in the WebSocket streami ...)
- TODO: check
+ NOT-FOR-US: req_llm
CVE-2026-106765 (An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: @rog0x/mcp-docker-tools
CVE-2026-106764 (An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to exe ...)
- TODO: check
+ NOT-FOR-US: @rog0x/mcp-git-tools
CVE-2026-106763 (An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote att ...)
- TODO: check
+ NOT-FOR-US: @justice8096/sagemath-mcp-server
CVE-2026-105963 (Externally-Generated Error Message Containing Sensitive Information vu ...)
TODO: check
CVE-2026-105199 (The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 d ...)
@@ -638,29 +638,29 @@ CVE-2026-105199 (The Pixel Tag Manager for WooCommerce WordPress plugin before
CVE-2026-102786 (Joomla Extension - phoca.cz - Authenticated stored cross-site scriptin ...)
NOT-FOR-US: Joomla
CVE-2025-58403 (CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-45528 (An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows ...)
- TODO: check
+ NOT-FOR-US: Nitro PDF
CVE-2025-30054 (CGM CLININET is vulnerable to local privilege escalation. The service ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30053 (The CGM CLININET application runs the cgm-updater process listening on ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30052 (The rsyncd service of the CGM CLININET is vulnerable to Authentication ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30051 (The CGM CLININET application stores the production database login and ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30050 (CGM CLININET is vulnerable to Code Injection in the RunCGI.pm componen ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30049 (The CGM CLININET application stores user passwords as unsalted MD5 has ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30047 (CGM CLININET is vulnerable to Remote Code Execution caused by deserial ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30046 (In the CGM CLININET application server, multiple processes responsible ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30045 (CGM CLININET is vulnerable to Code Injection in the ConvExpr function, ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2025-30043 (CGM CLININET is vulnerable to Missing Authentication for Critical Func ...)
- TODO: check
+ NOT-FOR-US: CGM CLININET
CVE-2026-XXXX [RUSTSEC-2026-0353]
- rust-wasmtime <not-affected> (Only affects 46 and later)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0353.html
@@ -2451,17 +2451,17 @@ CVE-2026-108357 (PhpSpreadsheet is a pure PHP library for reading and writing sp
CVE-2026-107861 (The system control service on affected Kiloview E3 NDI encoder firmwar ...)
NOT-FOR-US: E3
CVE-2026-107858 (Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cros ...)
- TODO: check
+ NOT-FOR-US: Google ADK for Java
CVE-2026-107079 (An issue in Systrome Validation & Certification 1.0 allows an attacker ...)
- TODO: check
+ NOT-FOR-US: Systrome
CVE-2026-106017 (Improper certificate validation in the OpenVPN 3 Core library version ...)
TODO: check
CVE-2026-105265 (A vulnerability exists in the the time zone parameter and does not pro ...)
- TODO: check
+ NOT-FOR-US: Kiloview
CVE-2026-105014 (Improper neutralization of special elements used in a command ('comman ...)
NOT-FOR-US: Microsoft
CVE-2026-104068 (JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102785 (Joomla Extension - yootheme.com - Unauthenticated remote code executio ...)
NOT-FOR-US: Joomla
CVE-2025-71434 (Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthen ...)
@@ -2473,51 +2473,51 @@ CVE-2025-65200 (An issue was discovered in localstack 4.9.2 allowing attackers t
CVE-2024-58396 (YouDataSum CPAS Audit Management System V4 contains a path traversal v ...)
NOT-FOR-US: YouDataSum CPAS Audit Management
CVE-2024-58394 (Retool before 3.88.0 contains a cross-site scripting vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: Retool
CVE-2024-58393 (i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) cont ...)
- TODO: check
+ NOT-FOR-US: i-Netsolution Readymade Unilevel Ecommerce MLM
CVE-2023-54413 (WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a ref ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2022-51026 (Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnera ...)
- TODO: check
+ NOT-FOR-US: Bytebase
CVE-2022-51025 (Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversa ...)
- TODO: check
+ NOT-FOR-US: Penta Security WAPPLES
CVE-2022-51024 (Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability th ...)
- TODO: check
+ NOT-FOR-US: Kavita
CVE-2022-51023 (PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability t ...)
- TODO: check
+ NOT-FOR-US: PHPOK
CVE-2022-51022 (YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unaut ...)
- TODO: check
+ NOT-FOR-US: YiShaAdmin
CVE-2022-51021 (NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an una ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2021-48017 (OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an ...)
- TODO: check
+ NOT-FOR-US: OrbiTeam BSCW Server
CVE-2021-48016 (DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability ...)
NOT-FOR-US: DedeCMS
CVE-2021-48015 (JeeWMS before commit 0a610e8 contains an unauthenticated path traversa ...)
- TODO: check
+ NOT-FOR-US: JeeWMS
CVE-2021-48014 (FineReport 9.0 contains a path traversal vulnerability in the /WebRepo ...)
- TODO: check
+ NOT-FOR-US: FineReport
CVE-2021-48013 (Weaver E-cology 8.0 contains a path traversal vulnerability that allow ...)
- TODO: check
+ NOT-FOR-US: Weaver E-cology
CVE-2020-37284 (Sickbeard through build-507 contains a reflected cross-site scripting ...)
- TODO: check
+ NOT-FOR-US: Sickbeard
CVE-2019-25779 (WooThemes Diarise through 1.5.9 contains a file read vulnerability tha ...)
- TODO: check
+ NOT-FOR-US: WooThemes Diarise
CVE-2019-25778 (SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerabi ...)
- TODO: check
+ NOT-FOR-US: SeaCMS
CVE-2018-25439 (MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: MetInfo CMS
CVE-2018-25438 (Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated ...)
- TODO: check
+ NOT-FOR-US: Intermesh Group-Office
CVE-2017-20290 (Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-s ...)
NOT-FOR-US: Discourse
CVE-2017-20289 (Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contain ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2017-20288 (QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting v ...)
- TODO: check
+ NOT-FOR-US: QCubed
CVE-2017-20287 (Javo Spot theme for WordPress before 3.0.0 contains a path traversal v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [OSSN-01111: oslo.utils can log LUKS key material]
- python-oslo.utils 10.2.0-4 (bug #1151658)
[trixie] - python-oslo.utils <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae0dbf43bc581a76605ffaa5eb7bfa90466b8e8d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae0dbf43bc581a76605ffaa5eb7bfa90466b8e8d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/5ccc02ff/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list