[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 28 07:15:11 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
cbdbd806 by security tracker role at 2026-10-28T07:15:01+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,31 +3,31 @@ CVE-2026-99100 (In the Linux kernel, the following vulnerability has been resolv
CVE-2026-97045 (In childTextNodesAreLiteral, walking up the tree previously stopped at ...)
TODO: check
CVE-2026-97019 (The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92098 (The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85898 (Access of resource using incompatible type ('type confusion') in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-84999 (The Pie Register Premium plugin for WordPress is vulnerable to Unrestr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-83831 (Double free in Microsoft Edge (Chromium-based) allows an unauthorized ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-78661 (When coalescing adjacent text nodes in addText and fosterParent, appen ...)
TODO: check
CVE-2026-77871 (The Post Snippets \u2013 Custom WordPress Code Snippets Customizer plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77188 (The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76780 (The Beyondseo plugin for WordPress is vulnerable to unauthorized acces ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76058 (The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76005 (The WP Inventory Manager plugin for WordPress is vulnerable to time-ba ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-63286 (Database backups are vulnerable to offline attacks. Backups created us ...)
- TODO: check
+ NOT-FOR-US: Axis Communication
CVE-2026-62765 (Access of resource using incompatible type ('type confusion') in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-59158 (Nuxt Ollama integrates the official Ollama JavaScript library into Nux ...)
TODO: check
CVE-2026-58496 (Thor Vector Graphics (ThorVG) is a production-ready vector graphics en ...)
@@ -61,15 +61,15 @@ CVE-2026-50571 (WebSub is a W3C recommendation produced by the Social Web Workin
CVE-2026-39928
REJECTED
CVE-2026-2839 (The Advanced Custom Fields: Extended plugin for WordPress is vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-22063 (The private keys of eight eMudhra intermediate CA certificates have be ...)
- TODO: check
+ NOT-FOR-US: NetApp
CVE-2026-1928 (The Rank Math SEO \u2013 AI SEO Tools to Dominate SEO Rankings plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-18326
REJECTED
CVE-2026-15323 (The Product Designer for WooCommerce WordPress | Lumise plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118384 (GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in ...)
TODO: check
CVE-2026-118378 (Tabularis before 0.28.0 contains an SQL injection vulnerability in its ...)
@@ -207,9 +207,9 @@ CVE-2026-118272 (A vulnerability was detected in a2ui-project a2ui up to 0.10.6.
CVE-2026-118271 (A security vulnerability has been detected in a2ui-project a2ui up to ...)
TODO: check
CVE-2026-118169 (The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118164 (The If-So Dynamic Content \u2013 Elementor & All Page Builders Persona ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118129 (A vulnerability was found in jeremyckahn Chitchatter up to f8253863381 ...)
TODO: check
CVE-2026-118128 (A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impac ...)
@@ -233,11 +233,11 @@ CVE-2026-116774 (russh is a Rust SSH client and server library that includes an
CVE-2026-116773 (russh is a Rust SSH client and server library that includes an SSH age ...)
TODO: check
CVE-2026-116761 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scrip ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116750 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116749 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116696 (russh is a Rust SSH client and server library that includes an SSH age ...)
TODO: check
CVE-2026-116695 (Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level ...)
@@ -247,11 +247,11 @@ CVE-2026-116694 (OpenTelemetry Python provides the Python API and SDK for OpenTe
CVE-2026-116693 (dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131 ...)
TODO: check
CVE-2026-116692 (MLflow is an open source AI engineering platform for agents, large lan ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-116691 (MLflow is an open source AI engineering platform for agents, large lan ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-116690 (MLflow is an open source AI engineering platform for agents, large lan ...)
- TODO: check
+ NOT-FOR-US: mlflow
CVE-2026-116689 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
TODO: check
CVE-2026-116688 (CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ...)
@@ -265,35 +265,35 @@ CVE-2026-116685 (The Model Context Protocol Python SDK is the official Python SD
CVE-2026-116684 (The Model Context Protocol Python SDK is the official Python SDK for M ...)
TODO: check
CVE-2026-116613 (The Animated Text Block plugin for WordPress is vulnerable to Sensitiv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116610 (The Clean Login plugin for WordPress is vulnerable to Missing Authoriz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116609 (The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115624 (GROWI contains a missing authorization check vulnerability in its coll ...)
TODO: check
CVE-2026-115522 (Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService ...)
TODO: check
CVE-2026-115281 (The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not san ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115255 (The WP Roster WordPress plugin before 2.35 does not perform any capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115225 (The Customer Engagement System WordPress plugin before 2.0.2 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115224 (The Customer Engagement System WordPress plugin before 2.0.2 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113813 (The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113494 (The GeoDirectory WordPress plugin before 2.8.195 does not perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113488 (The GeoDirectory WordPress plugin before 2.8.196 does not properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113487 (The GeoDirectory WordPress plugin before 2.8.196 does not properly sa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113486 (The Media Library Assistant WordPress plugin before 3.42 does not veri ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113485 (The Media Library Assistant WordPress plugin before 3.42 does not cons ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112355 (The MembershipWorks plugin for WordPress before 6.17 contains an infor ...)
TODO: check
CVE-2026-112352 (Sunhillo SureLine before 9.1.5 contains an authentication bypass vulne ...)
@@ -305,15 +305,15 @@ CVE-2026-112350 (Sunhillo SureLine before 9.1.5 contains a path traversal vulner
CVE-2026-112155
REJECTED
CVE-2026-111967 (The MP3 Audio Player WordPress plugin before 5.16 does not escape one ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111961 (The Royal MCP WordPress plugin before 1.5.10 does not perform an obje ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111960 (The Royal MCP WordPress plugin before 1.5.10 does not perform object- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111727 (The Appointment Booking Calendar plugin for WordPress is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111577 (The GoSMTP WordPress plugin before 1.2.5 does not perform a settings- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111563
REJECTED
CVE-2026-111479
@@ -321,121 +321,121 @@ CVE-2026-111479
CVE-2026-111467
REJECTED
CVE-2026-111372 (The AI ChatBot for WooCommerce \u2013 WoowBot plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111314 (The affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111255 (The affiliate-toolkit \u2013 Multi-Network Affiliate & Amazon Product ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111213 (The Travelly \u2013 Tour & Travel Booking Manager for WooCommerce plug ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111120 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111111 (The Prime Slider \u2013 Hero Slider, Carousel, WooCommerce & Post Slid ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111068 (The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111032 (The Welcart e-Commerce WordPress plugin before 2.12.6 does not properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111031 (The Welcart e-Commerce WordPress plugin before 2.12.6 does not validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111027 (The Welcart e-Commerce WordPress plugin before 2.12.6 does not properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111021 (The \u0627\u0641\u0632\u0648\u0646\u0647 \u067e\u06cc\u0627\u0645\u06a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110747 (ProtobufParser._readStringKey() reads the length prefix of a protobuf ...)
TODO: check
CVE-2026-110691 (The WPOrLogin WordPress plugin before 3.1.0 does not perform a capabi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110662 (The MxChat \u2013 AI Chatbot & Content Generation for WordPress plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110524 (The Copy Anything to Clipboard for WordPress WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110509 (The Essential Addons for Elementor WordPress plugin before 6.8.7 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110507 (The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110506 (The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110292 (The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110185 (The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110071 (The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110020 (The Rich Showcase for Google Reviews plugin for WordPress is vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109999 (The AI Marketing Expert \u2014 AI Email Marketing, AI Content Generato ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109988 (The Product Addons for Woocommerce \u2013 Product Options with Custom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109980 (The Related Posts for WordPress plugin for WordPress is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109979 (The Related Posts for WordPress plugin for WordPress is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109978 (The Cozy Blocks \u2013 Website Builder for WordPress Block Editor | Gu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109975 (The Cozy Blocks \u2013 Website Builder for WordPress Block Editor | Gu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109974 (The All-in-One Video Gallery \u2013 Video Player & Galleries for YouTu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109972 (The s2Member \u2013 Excellent for All Kinds of Memberships, Content Re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109848 (GROWI contains an authorization bypass vulnerability in its tag update ...)
TODO: check
CVE-2026-109590 (The Tour Booking Manager plugin for WordPress is vulnerable to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109385 (The UiChemy \u2013 Convert Figma, Prompts and AI Builds to Elementor, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109384 (The The Innovative Form Builder \u2013 IvyForms plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109381 (The Mage Eventpress plugin for WordPress is vulnerable to privilege es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109370 (The Document Embedder \u2013 let visitors read files without downloadi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109236 (The Customer Email Verification for WooCommerce plugin for WordPress i ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109218 (The Contact Manager plugin for WordPress is vulnerable to Arbitrary Fi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109209 (The All-in-One Video Gallery \u2013 Video Player & Galleries for YouTu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108366 (The easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, R ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107745 (The AI Engine \u2013 The Chatbot, AI Framework & MCP for WordPress plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107710 (The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107625 (The Ultimate Member \u2013 User Profile, Registration, Login, Member D ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107100 (The Royal Addons for Elementor WordPress plugin before 1.7.1070 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107098 (The Royal Addons for Elementor WordPress plugin before 1.7.1070 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107097 (The Royal Addons for Elementor WordPress plugin before 1.7.1070 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106647 (The Royal Addons for Elementor WordPress plugin before 1.7.1070 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106013 (The Jupiter X Core plugin for WordPress is vulnerable to Authenticatio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106003 (The Court Reservation WordPress plugin before 1.12.4 does not perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106002 (The Court Reservation WordPress plugin before 1.12.4 does not perform ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105997 (The Booking Package WordPress plugin before 1.7.33 does not restrict w ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105972 (The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not s ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105272 (GROWI contains an authorization bypass vulnerability in its page viewi ...)
TODO: check
CVE-2026-104895 (The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw- ...)
TODO: check
CVE-2026-104743 (The Tainacan plugin for WordPress is vulnerable to Directory Traversal ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104740 (The If-So Dynamic Content \u2013 Elementor & All Page Builders Persona ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104729 (The Avada (Fusion) Builder plugin for WordPress is vulnerable to Store ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104694 (The Thrive Automator WordPress plugin before 11.2 does not properly sa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104384 (Insufficiently Protected Credentials in tunnel gateway and provisionin ...)
TODO: check
CVE-2026-104383 (Improper Control of Generation of Code in Pigeon MFA service in EagleC ...)
@@ -443,21 +443,21 @@ CVE-2026-104383 (Improper Control of Generation of Code in Pigeon MFA service in
CVE-2026-104016 (ProtobufParser parses length-prefixed protobuf string and bytes fields ...)
TODO: check
CVE-2026-103996 (The If-So Dynamic Content \u2013 Elementor & All Page Builders Persona ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103995 (Response body and chunk parsing would handle non-hex or negative integ ...)
TODO: check
CVE-2026-103688 (The Checkout Files Upload for WooCommerce WordPress plugin before 2.4. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103382 (The Casso Flow WordPress plugin before 4.2.0 does not properly authen ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103372 (The Payconiq WordPress plugin through 1.0.4 does not check that a visi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103370 (The Awesome Support \u2013 WordPress HelpDesk & Support Plugin plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103331 (The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100175 (The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-12534
REJECTED
CVE-2015-20129 (CrushFTP before 7.3.0 contains a cross-site request forgery vulnerabil ...)
@@ -469,11 +469,11 @@ CVE-2014-125137 (C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.
CVE-2014-125136 (C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and ...)
TODO: check
CVE-2013-20009 (Linksys WAG200G through 1.01.06 contains a stored cross-site scripting ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2013-20008 (Linksys WAG200G through 1.01.06 contains a weak password change mechan ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2013-20007 (Linksys WAG200G through 1.01.06 contains an OS command injection vulne ...)
- TODO: check
+ NOT-FOR-US: Linksys
CVE-2026-XXXX [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling]
- phpunit 13.4.5+ds-1
[trixie] - phpunit <not-affected> (Vulnerable code introduced later)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbdbd80640469f42eb990fcf1b17b13c2ba56d53
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cbdbd80640469f42eb990fcf1b17b13c2ba56d53
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/13f1b174/attachment.htm>
More information about the debian-security-tracker-commits
mailing list