[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
68f3a5bc by Moritz Muehlenhoff at 2026-10-28T11:39:05+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -252,13 +252,13 @@ CVE-2026-117609 (rtl_433 through 25.12 contains a stack-based buffer overflow vu
 CVE-2026-117608 (Assimp through 6.0.5 contains an integer overflow vulnerability in MD2 ...)
 	TODO: check
 CVE-2026-117607 (Xerte Online Toolkits through 3.15.5 contains a remote code execution  ...)
-	TODO: check
+	NOT-FOR-US: Xerte Online Toolkits
 CVE-2026-117606 (NexoPOS through 6.3.0 contains a missing authorization vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: NexoPOS
 CVE-2026-117605 (nopCommerce before 5.00.0 contains a missing authorization vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: nopCommerce
 CVE-2026-116775 (pageant provides a PageantStream type that implements AsyncRead and As ...)
-	TODO: check
+	NOT-FOR-US: pageant
 CVE-2026-116774 (russh is a Rust SSH client and server library that includes an SSH age ...)
 	TODO: check
 CVE-2026-116773 (russh is a Rust SSH client and server library that includes an SSH age ...)
@@ -276,7 +276,7 @@ CVE-2026-116695 (Crass is a Ruby CSS parser that is compliant with the CSS Synta
 CVE-2026-116694 (OpenTelemetry Python provides the Python API and SDK for OpenTelemetry ...)
 	TODO: check
 CVE-2026-116693 (dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131 ...)
-	TODO: check
+	NOT-FOR-US: Node dd-trace
 CVE-2026-116692 (MLflow is an open source AI engineering platform for agents, large lan ...)
 	NOT-FOR-US: mlflow
 CVE-2026-116691 (MLflow is an open source AI engineering platform for agents, large lan ...)
@@ -302,7 +302,7 @@ CVE-2026-116610 (The Clean Login plugin for WordPress is vulnerable to Missing A
 CVE-2026-116609 (The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-115624 (GROWI contains a missing authorization check vulnerability in its coll ...)
-	TODO: check
+	NOT-FOR-US: GROWI
 CVE-2026-115522 (Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService  ...)
 	TODO: check
 CVE-2026-115281 (The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not san ...)
@@ -412,7 +412,7 @@ CVE-2026-109974 (The All-in-One Video Gallery \u2013 Video Player & Galleries fo
 CVE-2026-109972 (The s2Member \u2013 Excellent for All Kinds of Memberships, Content Re ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-109848 (GROWI contains an authorization bypass vulnerability in its tag update ...)
-	TODO: check
+	NOT-FOR-US: GROWI
 CVE-2026-109590 (The Tour Booking Manager plugin for WordPress is vulnerable to Stored  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-109385 (The UiChemy \u2013 Convert Figma, Prompts and AI Builds to Elementor,  ...)
@@ -456,7 +456,7 @@ CVE-2026-105997 (The Booking Package WordPress plugin before 1.7.33 does not res
 CVE-2026-105972 (The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not s ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-105272 (GROWI contains an authorization bypass vulnerability in its page viewi ...)
-	TODO: check
+	NOT-FOR-US: GROWI
 CVE-2026-104895 (The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw- ...)
 	TODO: check
 CVE-2026-104743 (The Tainacan plugin for WordPress is vulnerable to Directory Traversal ...)
@@ -492,13 +492,13 @@ CVE-2026-100175 (The Postie plugin for WordPress is vulnerable to Stored Cross-S
 CVE-2025-12534
 	REJECTED
 CVE-2015-20129 (CrushFTP before 7.3.0 contains a cross-site request forgery vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: CrushFTP
 CVE-2014-125138 (C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and  ...)
-	TODO: check
+	NOT-FOR-US: C97net qEngine CMS
 CVE-2014-125137 (C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and  ...)
-	TODO: check
+	NOT-FOR-US: C97net qEngine CMS
 CVE-2014-125136 (C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and  ...)
-	TODO: check
+	NOT-FOR-US: C97net qEngine CMS
 CVE-2013-20009 (Linksys WAG200G through 1.01.06 contains a stored cross-site scripting ...)
 	NOT-FOR-US: Linksys
 CVE-2013-20008 (Linksys WAG200G through 1.01.06 contains a weak password change mechan ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68f3a5bc16140ad72eaf3ebc9010f8c5e5599da9

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68f3a5bc16140ad72eaf3ebc9010f8c5e5599da9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/9f198c87/attachment-0001.htm>