[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
32f13c8d by Salvatore Bonaccorso at 2026-10-26T21:05:18+01:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -23,7 +23,7 @@ CVE-2026-95628 (Improper Limitation of a Pathname to a Restricted Directory ('Pa
 CVE-2026-94386 (Use of Cache Containing Sensitive Information vulnerability in Apache  ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-94380 (Weak Password Recovery Mechanism for Forgotten Password vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Liman MYS
 CVE-2026-93850 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
 	- mattermost-server <itp> (bug #823556)
 CVE-2026-93849 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
@@ -67,27 +67,27 @@ CVE-2026-81039 (The Bluetooth host pre-allocates a bt_conn object (a "reservatio
 CVE-2026-81038 (The Object Transfer Service server builds its Object Action Control Po ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-77062 (The boneIO Black web interface lacks proper clickjacking protections.  ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77061 (boneIO Black directly excludes several API endpoints from the authenti ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77060 (boneIO black_debian_images stores the Mosquitto MQTT broker password f ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77059 (boneIO Black contains a TOCTOU race condition in the create_timedatect ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77058 (boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77057 (boneIO Black does not limit authentication attempts on its web interfa ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77056 (boneIO black_debian_images ships with a Mosquitto MQTT broker that use ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77055 (boneIO black_debian_images gives the boneio service account excessive  ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77054 (boneIO Black stores passwords, including the MQTT broker and web panel ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77053 (boneIO Black firmware ships with authentication disabled by default. I ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-77052 (boneIO Black exposes a Node-RED instance without authentication at the ...)
-	TODO: check
+	NOT-FOR-US: boneIO Black
 CVE-2026-72758 (When parsing an AS range in Routinator, if the maximum value of the ra ...)
 	TODO: check
 CVE-2026-72757 (Routinator runs out of open connections on the HTTP server when many c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32f13c8d77917a0f0e8df7aa619c0217ce12fa91

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/32f13c8d77917a0f0e8df7aa619c0217ce12fa91
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/5427a6e7/attachment.htm>