[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Oct 28 22:11:46 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
387a5d41 by Moritz Muehlenhoff at 2026-10-28T23:11:24+01:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -271,7 +271,7 @@ CVE-2026-118485 (Axel Download Accelerator 2.17.14 and earlier performs URL perc
NOTE: https://github.com/axel-download-accelerator/axel/issues/477
NOTE: https://github.com/axel-download-accelerator/axel/pull/483
CVE-2026-118477 (The ei_git_repo_url parameter in the Git remote configuration endpoint ...)
- TODO: check
+ NOT-FOR-US: Kalifast
CVE-2026-118435 (Out-of-bounds write vulnerability in Samsung Open Source escargot allo ...)
TODO: check
CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractI ...)
@@ -304,7 +304,7 @@ CVE-2026-118260 (Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's
CVE-2026-118259 (opentelemetry-java is the Java implementation of the OpenTelemetry API ...)
NOT-FOR-US: opentelemetry-java
CVE-2026-118258 (i18next-http-backend is a backend layer for i18next that loads transla ...)
- TODO: check
+ NOT-FOR-US: i18next-http-backend
CVE-2026-118257 (Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 u ...)
NOT-FOR-US: Vue I18n
CVE-2026-118256 (Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-bet ...)
@@ -722,15 +722,15 @@ CVE-2026-116797 (Highcharts JS is a JavaScript charting library based on SVG. Fr
CVE-2026-116796 (Highcharts JS is a JavaScript charting library based on SVG. From 10.3 ...)
NOT-FOR-US: Highcharts JS
CVE-2026-116795 (RE2JS is the JavaScript port of RE2, a regular expression engine that ...)
- TODO: check
+ NOT-FOR-US: RE2JS
CVE-2026-116794 (russh is a Rust SSH client and server library that includes an SSH age ...)
- rust-russh <unfixed>
NOTE: https://github.com/Eugeny/russh/security/advisories/GHSA-vp5q-ff62-jwqv
NOTE: Fixed by: https://github.com/Eugeny/russh/commit/62db6e7defd6d244159da962ccccb029e785ce0f (v0.65.0)
CVE-2026-116778 (FOG is a free open-source cloning/imaging/rescue suite/inventory manag ...)
- TODO: check
+ NOT-FOR-US: FOG
CVE-2026-116776 (USB Test is a lightweight Windows CLI utility for verifying sector int ...)
- TODO: check
+ NOT-FOR-US: USB Test
CVE-2026-116593 (Apache Kafka Connect has the /connector-plugins/{connector-type}/confi ...)
- kafka <itp> (bug #786460)
CVE-2026-116404 (Missing Authorization vulnerability in David Anderson Redux Framework ...)
@@ -752,7 +752,7 @@ CVE-2026-115968 (Deserialization of Untrusted Data vulnerability in Ultimate Mem
CVE-2026-115957 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115904 (Topluyo is a social networking platform. A vulnerability exists in Top ...)
- TODO: check
+ NOT-FOR-US: Topluyo
CVE-2026-115644 (Apache Kafka Connect contains an authentication bypass vulnerability a ...)
- kafka <itp> (bug #786460)
CVE-2026-115612 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -774,7 +774,7 @@ CVE-2026-115591 (Insertion of Sensitive Information Into Sent Data vulnerability
CVE-2026-115590 (Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan- ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115402 (OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local us ...)
- TODO: check
+ NOT-FOR-US: OpenVPN ovpn-dco-win driver
CVE-2026-115223 (The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not pr ...)
NOT-FOR-US: WordPress plugin
CVE-2026-114349 (When a broker decodes a compressed record batch, the per-record decode ...)
@@ -784,13 +784,13 @@ CVE-2026-114278 (The che-machine-exec service constructs a shell command by conc
CVE-2026-112375 (An authenticated Kafka principal with no authorization grants (not eve ...)
- kafka <itp> (bug #786460)
CVE-2026-112357 (GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), ...)
- TODO: check
+ NOT-FOR-US: KerioConnect
CVE-2026-112356 (GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cros ...)
- TODO: check
+ NOT-FOR-US: KerioConnect
CVE-2026-112198 (XML External Entity (XXE) injection vulnerability in the SAFT import f ...)
- TODO: check
+ NOT-FOR-US: NoviGest Desktop App
CVE-2026-112197 (Vulnerability due to a lack of authentication in critical functions of ...)
- TODO: check
+ NOT-FOR-US: NoviGest Desktop App
CVE-2026-111850 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-111551 (Several Kafka deserialization paths read a size or count field from in ...)
@@ -828,7 +828,7 @@ CVE-2026-106971 (An integer overflow in the MessagePack\BufferUnpacker component
CVE-2026-106648 (The Royal Elementor Addons WordPress plugin before 1.7.1070 does not v ...)
NOT-FOR-US: WordPress plugin
CVE-2026-106484 (Insufficient policy enforcement in chrome-devtools-mcp in Google Chrom ...)
- TODO: check
+ NOT-FOR-US: chrome-devtools-mcp
CVE-2026-106079 (An Improper Neutralization of Special Elements used in an OS Command ( ...)
NOT-FOR-US: Juniper
CVE-2026-105620 (PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a r ...)
@@ -850,9 +850,9 @@ CVE-2026-105613 (PostgreSQL Anonymizer's range-based dummy functions dont constr
CVE-2026-105612 (PostgreSQL Anonymizer contains a vulnerability that data-modifying CTE ...)
TODO: check
CVE-2026-105457 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- TODO: check
+ NOT-FOR-US: Liman MYS
CVE-2026-105420 (Wing FTP Server does not verify user's base folder. An attacker with a ...)
- TODO: check
+ NOT-FOR-US: Wing FTP
CVE-2026-103799 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
NOT-FOR-US: Dell / EMC
CVE-2026-103792 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)
@@ -1842,7 +1842,7 @@ CVE-2026-116609 (The WP Visitor Statistics (Real Time Traffic) plugin for WordPr
CVE-2026-115624 (GROWI contains a missing authorization check vulnerability in its coll ...)
NOT-FOR-US: GROWI
CVE-2026-115522 (Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService ...)
- TODO: check
+ NOT-FOR-US: Google Agent Development Kit (ADK) for Python
CVE-2026-115281 (The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not san ...)
NOT-FOR-US: WordPress plugin
CVE-2026-115255 (The WP Roster WordPress plugin before 2.35 does not perform any capabi ...)
@@ -1864,13 +1864,13 @@ CVE-2026-113486 (The Media Library Assistant WordPress plugin before 3.42 does n
CVE-2026-113485 (The Media Library Assistant WordPress plugin before 3.42 does not cons ...)
NOT-FOR-US: WordPress plugin
CVE-2026-112355 (The MembershipWorks plugin for WordPress before 6.17 contains an infor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112352 (Sunhillo SureLine before 9.1.5 contains an authentication bypass vulne ...)
- TODO: check
+ NOT-FOR-US: Sunhillo SureLine
CVE-2026-112351 (Sunhillo SureLine before 9.1.5 contains an OS command injection vulner ...)
- TODO: check
+ NOT-FOR-US: Sunhillo SureLine
CVE-2026-112350 (Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: Sunhillo SureLine
CVE-2026-112155
REJECTED
CVE-2026-111967 (The MP3 Audio Player WordPress plugin before 5.16 does not escape one ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/387a5d411befb9bb42ada2929d5cd5ad7fae80db
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/387a5d411befb9bb42ada2929d5cd5ad7fae80db
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/1852135f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list