[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 29 07:14:10 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4c0ab5f3 by security tracker role at 2026-10-29T07:14:01+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,47 +1,47 @@
CVE-2026-96741 (The DSGVO All in one for WP plugin for WordPress is vulnerable to Stor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96669 (The Food Store \u2013 Online Food Delivery & Pickup plugin for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96666 (The Schema App Structured Data plugin for WordPress is vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96228 (SSL Wireless SMS Notification for WordPress is vulnerable to Authentic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93904 (The Social Web Suite \u2013 Social Media Auto Post, Social Media Auto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93855 (The SendPress Newsletters plugin for WordPress is vulnerable to time-b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93851 (Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7 ...)
TODO: check
CVE-2026-93757 (The Wild Apricot Login plugin for WordPress is vulnerable to Authentic ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93293 (The Password Protected plugin for WordPress is vulnerable to Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89216 (The vTables WordPress plugin before 0.3 does not properly sanitise an ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88928 (The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86983 (A remote attacker may be able to terminate a process that passes attac ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-86794 (The Community Events WordPress plugin before 1.6.0 does not have autho ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85749 (MailWatch for MailScanner is a web-based front-end to MailScanner. Pri ...)
TODO: check
CVE-2026-85007 (The Video Player for YouTube WordPress plugin before 2.1.4 does not p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82411 (Open Object provides an API and admin interface to manage objects and ...)
TODO: check
CVE-2026-78674 (The BPMN System REST APIs do not sufficiently validate input parameter ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-78396 (The Link Library WordPress plugin before 7.10.0 does not verify that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-78395 (The Link Library WordPress plugin before 7.10.0 does not re-check the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76418 (A vulnerability in the Remote Access SSL VPN service of Cisco Secure F ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-75520 (Domoticz is a free, open source home automation system for Linux, Wind ...)
TODO: check
CVE-2026-6647 (In deployments of WSO2 Identity Server configured with a case-insensit ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-66092 (In openEQUELLA before 2026.2, the pre-login notice is stored as HTML a ...)
TODO: check
CVE-2026-66091 (In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup en ...)
@@ -55,19 +55,19 @@ CVE-2026-66088 (In openEQUELLA before 2026.1, the system.execute() function avai
CVE-2026-63190 (FearlessCMS is a flat-file `content` management system centered on sim ...)
TODO: check
CVE-2026-61575 (AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` u ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61573 (AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous logi ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61572 (AVideo is a video-sharing Platform. Before the initial remediation att ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61571 (AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61569 (AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticate ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61567 (AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61564 (AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticate ...)
- TODO: check
+ NOT-FOR-US: WWBN AVideo
CVE-2026-61546 (AnkiMCP is an Anki addon that implements an MCP server, enabling AI as ...)
TODO: check
CVE-2026-61542 (Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and ...)
@@ -91,9 +91,9 @@ CVE-2026-42922 (A authorization bypass vulnerability exists in the /nodered func
CVE-2026-40063 (A information disclosure vulnerability exists in the /nodered/fuxa/scr ...)
TODO: check
CVE-2026-3583 (When the `allowed_scopes` configuration is enabled, the OAuth2 token i ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-21157 (Improper input validation in Bixby prior to version 4.0.85.6 allows pr ...)
- TODO: check
+ NOT-FOR-US: Samsung Mobile
CVE-2026-19610 (A flaw was found in the platform-mbean component of JBoss EAP, which p ...)
TODO: check
CVE-2026-16889 (In openEQUELLA before 2026.1, the pre-login notice image upload endpoi ...)
@@ -103,7 +103,7 @@ CVE-2026-15564 (Wildfly's IIOP listener may permit deserialization of input stre
CVE-2026-13451 (A flaw was found in KServe. A namespace-scoped user with create/update ...)
TODO: check
CVE-2026-11854 (The authentication endpoint generates an error message that includes r ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2026-118905 (Node Version Manager (nvm) is a POSIX-compliant shell function for man ...)
TODO: check
CVE-2026-118804 (Bricks Builder 2.4.3 and before contains a broken access control vulne ...)
@@ -117,7 +117,7 @@ CVE-2026-118756 (gopass before 1.17.0 contains a path traversal vulnerability in
CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an OS comman ...)
TODO: check
CVE-2026-118754 (Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulner ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-118753 (FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflo ...)
TODO: check
CVE-2026-118752 (FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflo ...)
@@ -185,7 +185,7 @@ CVE-2026-118586 (A security flaw has been discovered in dfm feedfinder2 up to 0.
CVE-2026-118585 (A vulnerability was identified in configuroweb inventariobasico c9377c ...)
TODO: check
CVE-2026-118579 (A weakness has been identified in D-Link DIR-505 1.10B02. The impacted ...)
- TODO: check
+ NOT-FOR-US: D-Link
CVE-2026-118578 (A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0. ...)
TODO: check
CVE-2026-118577 (A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0 ...)
@@ -195,7 +195,7 @@ CVE-2026-118538 (A vulnerability was determined in a2ui-project a2ui up to 0.12.
CVE-2026-118537 (A vulnerability was found in a2ui up to 0.10.4. This vulnerability aff ...)
TODO: check
CVE-2026-118426 (In affected versions of Octopus Server with the LDAP authentication pr ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...)
TODO: check
CVE-2026-118030 (A flaw was found in the HOTP authentication mechanism of the keycloak- ...)
@@ -213,39 +213,39 @@ CVE-2026-117548 (A NULL pointer dereference flaw was found in 389-ds-base. This
CVE-2026-116641 (The DB Tools rely on the TLS implementation in Golang\u2019s standard ...)
TODO: check
CVE-2026-115415 (Improper neutralization of input used for LLM prompting in the environ ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-115302 (The Contact Form by Supsystic WordPress plugin before 1.11.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115301 (The Contact Form by Supsystic WordPress plugin before 1.11.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115300 (The Contact Form by Supsystic WordPress plugin before 1.11.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115299 (The Contact Form by Supsystic WordPress plugin before 1.11.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115282 (The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not per ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115259 (The Photo Engine (Media Organizer & Lightroom) WordPress plugin before ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115245 (The Chat AI with Dispatcher WordPress plugin before 2.4 does not prope ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114488 (A flaw was found in Wildfly. A remote attacker can bypass authenticati ...)
TODO: check
CVE-2026-114270 (The GeoDirectory WordPress plugin before 2.8.197 does not honour post ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114173 (The Ortto plugin for WordPress before 1.0.25 did not filter the WooCom ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-113957 (An attacker who controls the registry, a mirror, or the network path t ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2026-113617 (The Automated Import Products to Cart WordPress plugin before 1.0.4 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113616 (The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-113409 (The Ortto plugin for WordPress before 1.0.25 did not escape stored set ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-113387 (The Ortto plugin for WordPress before 1.0.25 did not authenticate conf ...)
- TODO: check
+ NOT-FOR-US: Canva
CVE-2026-111739 (The Two Factor Authentication WordPress plugin before 1.17.0, All-In-O ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111575
REJECTED
CVE-2026-111486
@@ -253,29 +253,29 @@ CVE-2026-111486
CVE-2026-111478
REJECTED
CVE-2026-110983 (The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110505 (The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110504 (The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 doe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110030 (The Hide Price Until Login WordPress plugin before 1.1.2 does not rest ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109516 (The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108763 (The Wallet System for WooCommerce WordPress plugin before 2.8.2 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108686 (The WP Post Author WordPress plugin before 4.2.0 does not restrict th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108685 (The WP Post Author WordPress plugin before 4.2.0 does not check that ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105258 (The Appointment Booking Plugin WordPress plugin before 5.7.6 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103693 (The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-14260 (Due to the improper implementation of access control rules, the WSO2 p ...)
- TODO: check
+ NOT-FOR-US: WSO2
CVE-2024-3586 (The LetterPress WordPress plugin before 2.4.0 does not sanitise and e ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [GHSA-cp82-q55r-936c]
- amule 1:3.2.0-1
NOTE: https://github.com/amule-org/amule/security/advisories/GHSA-cp82-q55r-936c
@@ -596,7 +596,7 @@ CVE-2026-118485 (Axel Download Accelerator 2.17.14 and earlier performs URL perc
CVE-2026-118477 (The ei_git_repo_url parameter in the Git remote configuration endpoint ...)
NOT-FOR-US: Kalifast
CVE-2026-118435 (Out-of-bounds write vulnerability in Samsung Open Source escargot allo ...)
- TODO: check
+ NOT-FOR-US: Samsung
CVE-2026-118265 (Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractI ...)
- golang-github-labstack-echo <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg
@@ -1072,7 +1072,7 @@ CVE-2026-116390 (Deserialization of Untrusted Data vulnerability in stepasyuk Fi
CVE-2026-116389 (Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Me ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116078 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- TODO: check
+ NOT-FOR-US: Erlang Foundation software not packaged in Debian
CVE-2026-115968 (Deserialization of Untrusted Data vulnerability in Ultimate Member Ult ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-115957 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -1142,11 +1142,11 @@ CVE-2026-110540 (Dell PowerProtect Data Domain Management Center, Feature Releas
CVE-2026-110508 (The Essential Addons for Elementor WordPress plugin before 6.8.7 does ...)
NOT-FOR-US: WordPress plugin
CVE-2026-110183 (PostgreSQL Anonymizer contains a vulnerability related to static maski ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-110182 (PostgreSQL Anonymizer contains a vulnerability related to the anon.par ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-110181 (PostgreSQL Anonymizer contains a vulnerability related to anonymizatio ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-106972 (An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() ...)
TODO: check
CVE-2026-106971 (An integer overflow in the MessagePack\BufferUnpacker component of ryb ...)
@@ -1158,23 +1158,23 @@ CVE-2026-106484 (Insufficient policy enforcement in chrome-devtools-mcp in Googl
CVE-2026-106079 (An Improper Neutralization of Special Elements used in an OS Command ( ...)
NOT-FOR-US: Juniper
CVE-2026-105620 (PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a r ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105619 (PostgreSQL Anonymizer doesn't mask data accessed thru a security_invok ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105618 (PostgreSQL Anonymizer's documentation recommends applying rules on par ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105617 (PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule w ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105616 (PostgreSQL restricts acces to the salt and shift via the `SHOW` comman ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105615 (PostgreSQL's optimized statistics on a table are visible as long as yo ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105614 (PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105613 (PostgreSQL Anonymizer's range-based dummy functions dont constraint th ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105612 (PostgreSQL Anonymizer contains a vulnerability that data-modifying CTE ...)
- TODO: check
+ NOT-FOR-US: PostgreSQL software not packaged in Debian
CVE-2026-105457 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
NOT-FOR-US: Liman MYS
CVE-2026-105420 (Wing FTP Server does not verify user's base folder. An attacker with a ...)
@@ -1234,11 +1234,11 @@ CVE-2026-102790 (Joomla Extension - icagenda.com - Stored XSS via url-type even
CVE-2026-101935 (The Echo Knowledge Base \u2013 Documentation, FAQs, Chat & Smart Searc ...)
NOT-FOR-US: WordPress plugin
CVE-2026-101274 (When pretix is used as the identity provider in a Single-Sign-On (SSO) ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-101273 (Some of our API endpoints allowed to create order payments referencing ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-101272 (The mechanism binding files generated during a shredding process to th ...)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2026-100105 (A user with permission to edit contact points but not their protected ...)
NOT-FOR-US: Grafana
CVE-2025-30414 (Local privilege escalation due to improper authentication. The followi ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c0ab5f390e39b1fdca4f6ee5b1261c1a7a8ee57
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c0ab5f390e39b1fdca4f6ee5b1261c1a7a8ee57
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/4e683cfb/attachment.htm>
More information about the debian-security-tracker-commits
mailing list