[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Mon Oct 26 19:14:30 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c9deb45d by security tracker role at 2026-10-26T19:14:20+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,9 +1,9 @@
CVE-2026-97295 (Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97255 (Authorization Bypass Through User-Controlled Key vulnerability in WPro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97254 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97200 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability in ash- ...)
@@ -11,15 +11,15 @@ CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability i
CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS ACK can ...)
TODO: check
CVE-2026-95664 (Improper Neutralization of Special Elements used in an Expression Lang ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-95663 (Insufficient Session Expiration vulnerability in Apache Camel Keycloak ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-95629 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-95628 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94386 (Use of Cache Containing Sensitive Information vulnerability in Apache ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-94380 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
TODO: check
CVE-2026-93850 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
@@ -37,9 +37,9 @@ CVE-2026-93328 (Path Traversal and Missing Authorization in cloud-storage source
CVE-2026-92171 (A flaw was found in the Infinispan Operator for Red Hat Data Grid. Whe ...)
TODO: check
CVE-2026-90885 (Improper Restriction of XML External Entity Reference vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-89209 (A vulnerability has been identified in Mendix SAML (Mendix 10 compatib ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2026-85297 (Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on G ...)
TODO: check
CVE-2026-82947 (SOEM version 2.0.0 and earlier contains multiple vulnerabilities in fr ...)
@@ -53,17 +53,17 @@ CVE-2026-82944 (SOEM version 2.0.0 and earlier contains a vulnerability in multi
CVE-2026-82943 (SOEM version 2.0.0 and earlier contains vulnerabilities where a malici ...)
TODO: check
CVE-2026-82390 (The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-82389 (In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-82388 (bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocate ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-81509 (nforwardauth is a forward auth service that allows the use of a single ...)
TODO: check
CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn object (a "reservation") fr ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-81038 (The Object Transfer Service server builds its Object Action Control Po ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-77062 (The boneIO Black web interface lacks proper clickjacking protections. ...)
TODO: check
CVE-2026-77061 (boneIO Black directly excludes several API endpoints from the authenti ...)
@@ -101,9 +101,9 @@ CVE-2026-72753 (When Routinator encounters an RRDP notification file with gaps i
CVE-2026-72752 (Routinator runs out of memory when the JSON output is requested many t ...)
TODO: check
CVE-2026-71456 (Use of hard-coded cryptographic key vulnerability in Johnson Controls ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-71455 (Cleartext storage of sensitive information in memory vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Johnson Controls
CVE-2026-70388 (SOEM version 2.0.0 and earlier contains vulnerabilities where a malici ...)
TODO: check
CVE-2026-70379 (When the vSolution Matrix feature is enabled, affected devices may mak ...)
@@ -137,9 +137,9 @@ CVE-2026-59107 (A security vulnerability has been identified in the vSolution Ma
CVE-2026-59106 (A security vulnerability has been identified in the WolfProt interface ...)
TODO: check
CVE-2026-50096 (There is a reflected cross site scripting vulnerability in Esri Portal ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-50095 (There is a stored cross site scripting issue in Esri ArcGIS Server 11. ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-4316 (Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGy ...)
TODO: check
CVE-2026-3322 (Due to improper permission checks inLobster_pro, attackers are able to ...)
@@ -147,15 +147,15 @@ CVE-2026-3322 (Due to improper permission checks inLobster_pro, attackers are ab
CVE-2026-36698 (Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10 ...)
TODO: check
CVE-2026-33522 (Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthe ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-33521 (There is s denial of service vulnerability in Esri ArcGIS Server versi ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-33520 (There is a reflected cross site scripting vulnerability in Esri Portal ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-31158 (SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradein ...)
TODO: check
CVE-2026-19742 (The IPv6 stack derived the long-lived secret key used to compute RFC 7 ...)
- TODO: check
+ NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-116638 (The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allo ...)
TODO: check
CVE-2026-116634 (OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulne ...)
@@ -187,7 +187,7 @@ CVE-2026-116516 (Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to vali
CVE-2026-116497 (A NULL pointer dereference vulnerability was found in gssproxy. When a ...)
TODO: check
CVE-2026-116492 (Frappe CRM app before 1.89.1 contains a missing authorization vulnerab ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-116489 (Timescale pgvectorscale before 0.9.1 contains a type confusion vulnera ...)
TODO: check
CVE-2026-116488 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13 ...)
@@ -211,21 +211,21 @@ CVE-2026-116463 (A vulnerability was identified in FastStone Image Viewer up to
CVE-2026-116461 (A vulnerability was determined in Omega Solution Restro POS up to 2026 ...)
TODO: check
CVE-2026-116408 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116403 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116400 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116398 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116396 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116395 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116394 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116388 (Missing Authorization vulnerability in TMS Amelia ameliabooking allows ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116385 (A security vulnerability has been detected in Bdtask Garage 24 Garage ...)
TODO: check
CVE-2026-116384 (A weakness has been identified in Bdtask Garage 24 Garage Management S ...)
@@ -281,7 +281,7 @@ CVE-2026-116255 (A vulnerability has been found in PGYER codefever up to 0c35e60
CVE-2026-116254 (A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c ...)
TODO: check
CVE-2026-116253 (A vulnerability was determined in DedeCMS 5.7.118. This vulnerability ...)
- TODO: check
+ NOT-FOR-US: DedeCMS
CVE-2026-116237 (A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affect ...)
TODO: check
CVE-2026-116236 (A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affect ...)
@@ -301,9 +301,9 @@ CVE-2026-116230 (A vulnerability was identified in Ndemic Creations Plague Inc E
CVE-2026-116229 (A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up t ...)
TODO: check
CVE-2026-116219 (Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulner ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-116218 (Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulner ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-116217 (RosarioSIS before 12.9.2 contains a reflected cross-site scripting vul ...)
TODO: check
CVE-2026-116216 (MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerabi ...)
@@ -319,31 +319,31 @@ CVE-2026-116212 (Webasyst Framework through 4.4.0 contains a stored cross-site s
CVE-2026-116210 (Webasyst Framework through 4.4.0 contains a cross-site request forgery ...)
TODO: check
CVE-2026-115966 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115961 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115960 (Missing Authorization vulnerability in WPExperts APIExperts Square for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115959 (Missing Authorization vulnerability in WPExperts APIExperts Square for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115958 (Missing Authorization vulnerability in WP Discussion Board WP Discussi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115956 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115955 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115954 (Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mash ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115953 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115951 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115950 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115949 (Missing Authorization vulnerability in WP Smart Widgets Better Post & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115948 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115930 (The MongoDB Shell (mongosh) relies on Node.jsas a third-party runtime ...)
TODO: check
CVE-2026-115923 (Backstage is an open framework for building developer portals. Prior t ...)
@@ -391,11 +391,11 @@ CVE-2026-115748 (**UNSUPPORTED WHEN ASSIGNED**Authorization bypass in Apache Vys
CVE-2026-115721 (**UNSUPPORTED WHEN ASSIGNED**Unbounded allocation in XML parsing in Ap ...)
TODO: check
CVE-2026-115720 (Frappe Builder before 1.36.1 contains a server-side request forgery vu ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-115718 (Frappe Builder versions 1.33.0 before1.36.0 contain a missing authoriz ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-115717 (Frappe Builder versions before 1.36.1 contain a server-side request fo ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-115700 (Interpretation Conflict vulnerability in hackney_url in benoitc hackne ...)
TODO: check
CVE-2026-115693 (Improper Certificate Validation vulnerability in hackney_ssl in benoit ...)
@@ -407,25 +407,25 @@ CVE-2026-115679 (Arm Keil MDK-Middleware 8.3.0 may allowout-of-boundsreads and w
CVE-2026-115678 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowpre-authentication out-of ...)
TODO: check
CVE-2026-115614 (Missing Authorization vulnerability in Magepeople inc. Booking and Ren ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115613 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115608 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115602 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115598 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115597 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115595 (Missing Authorization vulnerability in Supsystic Contact Form by Supsy ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115594 (Insertion of Sensitive Information Into Sent Data vulnerability in Dav ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115425 (Multiple cross site scripting (XSS) vulnerabilities affectOPNsense fir ...)
TODO: check
CVE-2026-115418 (SQL injection in the database-query custom resource handlers in the Am ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115269 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-115196 (An Open Redirect vulnerability exists in the public form submission en ...)
@@ -447,13 +447,13 @@ CVE-2026-115189 (A server-side template injection vulnerability exists in the Tw
CVE-2026-115188 (An unrestricted file upload vulnerability exists in the campaign impor ...)
TODO: check
CVE-2026-114710 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114709 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114708 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114707 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114216 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response S ...)
TODO: check
CVE-2026-114213 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
@@ -467,11 +467,11 @@ CVE-2026-113436 (Inefficient Algorithmic Complexity vulnerability in the header
CVE-2026-112880 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Reque ...)
TODO: check
CVE-2026-112865 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112839 (Missing Authorization vulnerability in VillaTheme Customer Coupons for ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112828 (Missing Authorization vulnerability in Meow Apps AI Engine ai-engine a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112346 (OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated ...)
TODO: check
CVE-2026-112345 (TTLock Android application before v9.8.260718 and associated smart-loc ...)
@@ -481,21 +481,21 @@ CVE-2026-112344 (Syncplify Server! before 8.8.0 contains a path traversal vulner
CVE-2026-112343 (Syncplify Server! before 8.8.0 contains an access control bypass vulne ...)
TODO: check
CVE-2026-112250 (A vulnerability has been identified in BRAIN2 versions up to and inclu ...)
- TODO: check
+ NOT-FOR-US: Bizerba
CVE-2026-111841 (Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Auto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111590 (A wide range of Harbor versions allow SSRF via its webhook delivery co ...)
TODO: check
CVE-2026-111404 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-111103 (Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handl ...)
TODO: check
CVE-2026-111101 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-110748 (This issue affects Apache SIS from version 0.7 through 1.6 inclusive. ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-110733 (Vulnerability in the SQL storage module of Apache SIS. When sorting a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-110720 (Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespa ...)
TODO: check
CVE-2026-110499 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
@@ -505,13 +505,13 @@ CVE-2026-110475 (This vulnerability exists in the CreditNirvana Collections Plat
CVE-2026-110474 (This vulnerability exists in the CreditNirvana Agentic AI Call Centre ...)
TODO: check
CVE-2026-110377 (Missing Authorization vulnerability in VillaTheme Bopo \u2013 WooComme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110376 (Missing Authorization vulnerability in VillaTheme DEPART depart-deposi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110314 (Client-Side Enforcement of Server-Side Security vulnerability in the W ...)
TODO: check
CVE-2026-10757 (There is a SQL injection vulnerability in Esri ArcGIS Server versions ...)
- TODO: check
+ NOT-FOR-US: Esri
CVE-2026-109584 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
TODO: check
CVE-2026-108529 (Inefficient Algorithmic Complexity vulnerability in the HTTP/2 impleme ...)
@@ -519,7 +519,7 @@ CVE-2026-108529 (Inefficient Algorithmic Complexity vulnerability in the HTTP/2
CVE-2026-108525 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
TODO: check
CVE-2026-107656 (An authentication bypass using an alternate path or channel vulnerabil ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2026-107157 (Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt ...)
TODO: check
CVE-2026-107092 (NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update ...)
@@ -557,7 +557,7 @@ CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been i
CVE-2026-102649 (Burrito is a Terraform Automation Collaboration Software (TACoS) Kuber ...)
TODO: check
CVE-2026-101259 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2013-10077 (A weakness has been identified in OctoPrint 1.0.0. This impacts the fu ...)
TODO: check
CVE-2012-20006
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9deb45d3585c959a18e9ce196da7c597db10b85
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9deb45d3585c959a18e9ce196da7c597db10b85
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/5432b7c0/attachment.htm>
More information about the debian-security-tracker-commits
mailing list