[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Oct 27 05:23:39 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
cde3381a by Salvatore Bonaccorso at 2026-10-27T06:21:42+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -158,9 +158,9 @@ CVE-2026-50096 (There is a reflected cross site scripting vulnerability in Esri
CVE-2026-50095 (There is a stored cross site scripting issue in Esri ArcGIS Server 11. ...)
NOT-FOR-US: Esri
CVE-2026-4316 (Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGy ...)
- TODO: check
+ NOT-FOR-US: Gym Management Software IsMyGym
CVE-2026-3322 (Due to improper permission checks inLobster_pro, attackers are able to ...)
- TODO: check
+ NOT-FOR-US: Lobster_pro
CVE-2026-36698 (Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10 ...)
NOT-FOR-US: Xovis
CVE-2026-33522 (Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthe ...)
@@ -205,27 +205,27 @@ CVE-2026-116497 (A NULL pointer dereference vulnerability was found in gssproxy.
CVE-2026-116492 (Frappe CRM app before 1.89.1 contains a missing authorization vulnerab ...)
NOT-FOR-US: Frappe
CVE-2026-116489 (Timescale pgvectorscale before 0.9.1 contains a type confusion vulnera ...)
- TODO: check
+ NOT-FOR-US: Timescale pgvectorscale
CVE-2026-116488 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13 ...)
- TODO: check
+ NOT-FOR-US: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb)
CVE-2026-116487 (NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13 ...)
- TODO: check
+ NOT-FOR-US: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb)
CVE-2026-116486 (Objenesis before 3.6 contains a type confusion vulnerability that allo ...)
TODO: check
CVE-2026-116485 (danmu_api before 1.21.7 contains an authentication bypass vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: danmu_api
CVE-2026-116476 (A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-pr ...)
- TODO: check
+ NOT-FOR-US: a2aproject a2a-dotnet
CVE-2026-116471 (A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The i ...)
- TODO: check
+ NOT-FOR-US: BKWLD Decoy
CVE-2026-116469 (MISP Guard, a proxy-based security filter for MISP (Malware Informatio ...)
- TODO: check
+ NOT-FOR-US: MISP Guard
CVE-2026-116467 (A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. ...)
TODO: check
CVE-2026-116463 (A vulnerability was identified in FastStone Image Viewer up to 8.5. Af ...)
- TODO: check
+ NOT-FOR-US: FastStone Image Viewer
CVE-2026-116461 (A vulnerability was determined in Omega Solution Restro POS up to 2026 ...)
- TODO: check
+ NOT-FOR-US: Omega Solution Restro POS
CVE-2026-116408 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116403 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
@@ -243,41 +243,41 @@ CVE-2026-116394 (Improper Neutralization of Script-Related HTML Tags in a Web Pa
CVE-2026-116388 (Missing Authorization vulnerability in TMS Amelia ameliabooking allows ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116385 (A security vulnerability has been detected in Bdtask Garage 24 Garage ...)
- TODO: check
+ NOT-FOR-US: Bdtask Garage 24 Garage Management Software
CVE-2026-116384 (A weakness has been identified in Bdtask Garage 24 Garage Management S ...)
- TODO: check
+ NOT-FOR-US: Bdtask Garage 24 Garage Management Software
CVE-2026-116372 (MISP mispguard is a security filtering proxy that inspects and blocks ...)
- TODO: check
+ NOT-FOR-US: MISP Guard
CVE-2026-116371 (A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.4 ...)
- TODO: check
+ NOT-FOR-US: Akuvox Akubela HyPanel PS51
CVE-2026-116370 (A security flaw has been discovered in 2K Games Sid Meier's Civilizati ...)
- TODO: check
+ NOT-FOR-US: 2K Games Sid Meier's Civilization IV
CVE-2026-116369 (A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-se ...)
- TODO: check
+ NOT-FOR-US: Sunwood-ai-labs github-kanban-mcp-server
CVE-2026-116368 (A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. T ...)
- TODO: check
+ NOT-FOR-US: DeepSeek Harness
CVE-2026-116367 (A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This v ...)
- TODO: check
+ NOT-FOR-US: DeepSeek Harness
CVE-2026-116340 (A vulnerability was identified in iFlytek astron-agent up to 1.1.2. Th ...)
- TODO: check
+ NOT-FOR-US: iFlytek astron-agent
CVE-2026-116339 (A vulnerability was determined in iFlytek astron-agent up to 1.1.2. Th ...)
- TODO: check
+ NOT-FOR-US: iFlytek astron-agent
CVE-2026-116284 (A security vulnerability has been detected in Kameleo up to 5.3.1. Thi ...)
- TODO: check
+ NOT-FOR-US: Kameleo
CVE-2026-116283 (A weakness has been identified in Kameleo up to 5.0.1.26. This affects ...)
- TODO: check
+ NOT-FOR-US: Kameleo
CVE-2026-116282 (A security flaw has been discovered in Kameleo up to 5.3.1. Affected b ...)
- TODO: check
+ NOT-FOR-US: Kameleo
CVE-2026-116281 (A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by ...)
- TODO: check
+ NOT-FOR-US: Kameleo
CVE-2026-116280 (A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is ...)
- TODO: check
+ NOT-FOR-US: Kameleo
CVE-2026-116275 (A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impac ...)
- TODO: check
+ NOT-FOR-US: AllenAI AllenNLP
CVE-2026-116274 (A vulnerability has been found in JIZHICMS up to 2.5.6. This affects t ...)
- TODO: check
+ NOT-FOR-US: JIZHICMS
CVE-2026-116263 (A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The i ...)
- TODO: check
+ NOT-FOR-US: HaschekSolutions PictShare
CVE-2026-116262 (A vulnerability was detected in libimobiledevice up to 1.4.0. The affe ...)
TODO: check
CVE-2026-116261 (A security vulnerability has been detected in libimobiledevice up to 1 ...)
@@ -289,51 +289,51 @@ CVE-2026-116259 (A security flaw has been discovered in libimobiledevice up to 1
CVE-2026-116258 (A vulnerability was identified in libimobiledevice up to 1.4.0. This a ...)
TODO: check
CVE-2026-116257 (A vulnerability was determined in BillaBear up to 2025.01.03. Affected ...)
- TODO: check
+ NOT-FOR-US: BillaBear
CVE-2026-116256 (A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627fa ...)
- TODO: check
+ NOT-FOR-US: geesondog RhaPHP
CVE-2026-116255 (A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d ...)
- TODO: check
+ NOT-FOR-US: PGYER codefever
CVE-2026-116254 (A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c ...)
- TODO: check
+ NOT-FOR-US: rathena FluxCP
CVE-2026-116253 (A vulnerability was determined in DedeCMS 5.7.118. This vulnerability ...)
NOT-FOR-US: DedeCMS
CVE-2026-116237 (A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affect ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116236 (A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affect ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116235 (A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by thi ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116234 (A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116233 (A security vulnerability has been detected in Oray Pugongying X5 Pro 7 ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116232 (A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This a ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116231 (A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. T ...)
- TODO: check
+ NOT-FOR-US: Oray Pugongying X5 Pro
CVE-2026-116230 (A vulnerability was identified in Ndemic Creations Plague Inc Evolved ...)
- TODO: check
+ NOT-FOR-US: Ndemic Creations Plague Inc Evolved
CVE-2026-116229 (A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up t ...)
- TODO: check
+ NOT-FOR-US: ffxiv-teamcraft FFXIV Teamcraft
CVE-2026-116219 (Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulner ...)
NOT-FOR-US: Dolibarr
CVE-2026-116218 (Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulner ...)
NOT-FOR-US: Dolibarr
CVE-2026-116217 (RosarioSIS before 12.9.2 contains a reflected cross-site scripting vul ...)
- TODO: check
+ NOT-FOR-US: RosarioSIS
CVE-2026-116216 (MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerabi ...)
- TODO: check
+ NOT-FOR-US: MacCMS
CVE-2026-116215 (MacCMS v10 through 2026.1000.4056 contains a race condition vulnerabil ...)
- TODO: check
+ NOT-FOR-US: MacCMS
CVE-2026-116214 (MacCMS v10 before 2026.1000.4054 contains an authentication bypass vul ...)
- TODO: check
+ NOT-FOR-US: MacCMS
CVE-2026-116213 (Webasyst Framework through 4.4.0 contains an arbitrary file read vulne ...)
- TODO: check
+ NOT-FOR-US: Webasyst
CVE-2026-116212 (Webasyst Framework through 4.4.0 contains a stored cross-site scriptin ...)
- TODO: check
+ NOT-FOR-US: Webasyst
CVE-2026-116210 (Webasyst Framework through 4.4.0 contains a cross-site request forgery ...)
- TODO: check
+ NOT-FOR-US: Webasyst
CVE-2026-115966 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115961 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -431,13 +431,13 @@ CVE-2026-115717 (Frappe Builder versions before 1.36.1 contain a server-side req
CVE-2026-115700 (Interpretation Conflict vulnerability in hackney_url in benoitc hackne ...)
TODO: check
CVE-2026-115693 (Improper Certificate Validation vulnerability in hackney_ssl in benoit ...)
- TODO: check
+ NOT-FOR-US: benoitc hackney
CVE-2026-115680 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowDHCPv6 Option-Walk Over-R ...)
- TODO: check
+ NOT-FOR-US: Arm Keil MDK-Middleware
CVE-2026-115679 (Arm Keil MDK-Middleware 8.3.0 may allowout-of-boundsreads and writes t ...)
- TODO: check
+ NOT-FOR-US: Arm Keil MDK-Middleware
CVE-2026-115678 (Arm Keil MDK-Middleware 8.0.0-8.3.0 may allowpre-authentication out-of ...)
- TODO: check
+ NOT-FOR-US: Arm Keil MDK-Middleware
CVE-2026-115614 (Missing Authorization vulnerability in Magepeople inc. Booking and Ren ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115613 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -455,29 +455,29 @@ CVE-2026-115595 (Missing Authorization vulnerability in Supsystic Contact Form b
CVE-2026-115594 (Insertion of Sensitive Information Into Sent Data vulnerability in Dav ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115425 (Multiple cross site scripting (XSS) vulnerabilities affectOPNsense fir ...)
- TODO: check
+ NOT-FOR-US: OPNsense
CVE-2026-115418 (SQL injection in the database-query custom resource handlers in the Am ...)
NOT-FOR-US: Amazon
CVE-2026-115269 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-115196 (An Open Redirect vulnerability exists in the public form submission en ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115195 (A broken access control vulnerability exists in the Mautic Stats API ( ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115194 (A path traversal vulnerability exists in the Mautic Asset API. When cr ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115193 (A stored Cross-Site Scripting (XSS) vulnerability exists in the contac ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115192 (An SQL Injection vulnerability exists in the dashboard widget data API ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115191 (A SQL injection vulnerability exists in a contact lookup AJAX endpoint ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115190 (An insecure deserialization (PHP object injection) vulnerability exist ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115189 (A server-side template injection vulnerability exists in the Twig them ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-115188 (An unrestricted file upload vulnerability exists in the campaign impor ...)
- TODO: check
+ NOT-FOR-US: Mautic
CVE-2026-114710 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-114709 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -487,17 +487,17 @@ CVE-2026-114708 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-114707 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-114216 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response S ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-114213 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-113440 (Insufficiently Protected Credentials vulnerability in hackney in benoi ...)
- TODO: check
+ NOT-FOR-US: benoitc hackney
CVE-2026-113438 (Pleasanter provided fails to properly verify passwords in LDAP authent ...)
- TODO: check
+ NOT-FOR-US: Pleasanter
CVE-2026-113436 (Inefficient Algorithmic Complexity vulnerability in the header integer ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-112880 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Reque ...)
- TODO: check
+ NOT-FOR-US: benoitc hackney
CVE-2026-112865 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112839 (Missing Authorization vulnerability in VillaTheme Customer Coupons for ...)
@@ -505,61 +505,61 @@ CVE-2026-112839 (Missing Authorization vulnerability in VillaTheme Customer Coup
CVE-2026-112828 (Missing Authorization vulnerability in Meow Apps AI Engine ai-engine a ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-112346 (OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated ...)
- TODO: check
+ NOT-FOR-US: OpenHands Software Agent SDK
CVE-2026-112345 (TTLock Android application before v9.8.260718 and associated smart-loc ...)
- TODO: check
+ NOT-FOR-US: TTLock Android
CVE-2026-112344 (Syncplify Server! before 8.8.0 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Syncplify Server!
CVE-2026-112343 (Syncplify Server! before 8.8.0 contains an access control bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Syncplify Server!
CVE-2026-112250 (A vulnerability has been identified in BRAIN2 versions up to and inclu ...)
NOT-FOR-US: Bizerba
CVE-2026-111841 (Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Auto ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111590 (A wide range of Harbor versions allow SSRF via its webhook delivery co ...)
- TODO: check
+ NOT-FOR-US: Harbor
CVE-2026-111404 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111103 (Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handl ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-111101 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-110748 (This issue affects Apache SIS from version 0.7 through 1.6 inclusive. ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-110733 (Vulnerability in the SQL storage module of Apache SIS. When sorting a ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-110720 (Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespa ...)
- TODO: check
+ NOT-FOR-US: Consul-k8s
CVE-2026-110499 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-110475 (This vulnerability exists in the CreditNirvana Collections Platform du ...)
- TODO: check
+ NOT-FOR-US: CreditNirvana Collections Platform
CVE-2026-110474 (This vulnerability exists in the CreditNirvana Agentic AI Call Centre ...)
- TODO: check
+ NOT-FOR-US: CreditNirvana
CVE-2026-110377 (Missing Authorization vulnerability in VillaTheme Bopo \u2013 WooComme ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110376 (Missing Authorization vulnerability in VillaTheme DEPART depart-deposi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110314 (Client-Side Enforcement of Server-Side Security vulnerability in the W ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-10757 (There is a SQL injection vulnerability in Esri ArcGIS Server versions ...)
NOT-FOR-US: Esri
CVE-2026-109584 (Improper Handling of Highly Compressed Data (Data Amplification) vulne ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-108529 (Inefficient Algorithmic Complexity vulnerability in the HTTP/2 impleme ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-108525 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-107656 (An authentication bypass using an alternate path or channel vulnerabil ...)
NOT-FOR-US: Fortinet
CVE-2026-107157 (Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt ...)
TODO: check
CVE-2026-107092 (NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update ...)
- TODO: check
+ NOT-FOR-US: NexoPOS
CVE-2026-107091 (An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 al ...)
- TODO: check
+ NOT-FOR-US: HUION Inspiroy Frego S (L310) Windows Driver
CVE-2026-107090 (An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 ...)
- TODO: check
+ NOT-FOR-US: Maltego Technologies GmbH Maltego Windows Installer
CVE-2026-107080 (OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, ...)
- openjpeg2 <unfixed>
NOTE: https://github.com/uclouvain/openjpeg/issues/1673
@@ -567,13 +567,13 @@ CVE-2026-107080 (OpenJPEG 2.4.0 through 2.5.4, and git master through commit 831
NOTE: Introduced with: https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33 (v2.4.0)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/05/5
CVE-2026-106781 (An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package ...)
- TODO: check
+ NOT-FOR-US: WCH CH340/CH341 USB-to-Serial Windows Driver setup package
CVE-2026-106677 (Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServ ...)
- TODO: check
+ NOT-FOR-US: Homestay3 homestay-backend
CVE-2026-106676 (qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in Cart ...)
- TODO: check
+ NOT-FOR-US: qiujie mall-server
CVE-2026-105947 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Logsign SIEM
CVE-2026-105765 (HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerab ...)
TODO: check
CVE-2026-105626 (HashiCorp Consul and Consul Enterprise are vulnerable to a denial of s ...)
@@ -589,9 +589,9 @@ CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in th
CVE-2026-104591 (libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_com ...)
TODO: check
CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been identifi ...)
- TODO: check
+ NOT-FOR-US: Castile-La Mancha Regional Parliament's video library
CVE-2026-102649 (Burrito is a Terraform Automation Collaboration Software (TACoS) Kuber ...)
- TODO: check
+ NOT-FOR-US: Burrito
CVE-2026-101259 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2013-10077 (A weakness has been identified in OctoPrint 1.0.0. This impacts the fu ...)
@@ -723,7 +723,7 @@ CVE-2026-116097 (A security vulnerability has been detected in CloudClassroom-PH
CVE-2026-116096 (A weakness has been identified in ggml-org llama.cpp. Affected by this ...)
TODO: check
CVE-2026-116095 (A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1. ...)
- TODO: check
+ NOT-FOR-US: smg-project smg
CVE-2026-116094 (A vulnerability was determined in EyouCMS up to 1.8.3. This impacts th ...)
NOT-FOR-US: EyouCMS
CVE-2026-115635 (Incorrect Authorization vulnerability in ash-project ash_postgres allo ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cde3381a6e0138ea4d32a7ba0ad7b04bd8666f26
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cde3381a6e0138ea4d32a7ba0ad7b04bd8666f26
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/f6b53be0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list