[Git][security-tracker-team/security-tracker][master] NFUs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
08898aea by Moritz Muehlenhoff at 2026-10-29T16:28:39+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,5 @@
+CVE-2026-116470
+	- keycloak <itp> (bug #1088287)
 CVE-2026-XXXX [GHSA-p8g6-qw5j-8cgc: Local users can run code as root when Tigris audits a running system]
 	- tiger <unfixed>
 	NOTE: https://github.com/creativeheadz/tigris/security/advisories/GHSA-p8g6-qw5j-8cgc
@@ -255,17 +257,17 @@ CVE-2026-118589 (A weakness has been identified in nschloe meshio up to 5.3.5. I
 CVE-2026-118586 (A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. Th ...)
 	TODO: check
 CVE-2026-118585 (A vulnerability was identified in configuroweb inventariobasico c9377c ...)
-	TODO: check
+	NOT-FOR-US: inventariobasico
 CVE-2026-118579 (A weakness has been identified in D-Link DIR-505 1.10B02. The impacted ...)
 	NOT-FOR-US: D-Link
 CVE-2026-118578 (A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0. ...)
-	TODO: check
+	NOT-FOR-US: MusicFreeDesktop
 CVE-2026-118577 (A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0 ...)
-	TODO: check
+	NOT-FOR-US: MusicFreeDesktop
 CVE-2026-118538 (A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This ...)
-	TODO: check
+	NOT-FOR-US: a2ui
 CVE-2026-118537 (A vulnerability was found in a2ui up to 0.10.4. This vulnerability aff ...)
-	TODO: check
+	NOT-FOR-US: a2ui
 CVE-2026-118426 (In affected versions of Octopus Server with the LDAP authentication pr ...)
 	NOT-FOR-US: Octopus Deploy
 CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...)
@@ -274,15 +276,15 @@ CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's M
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
 	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118030 (A flaw was found in the HOTP authentication mechanism of the keycloak- ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-117859 (A flaw was found in the Pushed Authorization Request PAR implementatio ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-117688 (A flaw was found in the client registration component of Keycloak, an  ...)
-	TODO: check
+	- keycloak <itp> (bug #1088287)
 CVE-2026-117627 (A flaw was found in the JWT Authorization Grant implementation of the  ...)
 	TODO: check
 CVE-2026-117574 (A flaw was found in ai-gateway-payload-processing. An authenticated re ...)
-	TODO: check
+	NOT-FOR-US: ai-gateway-payload-processing
 CVE-2026-117548 (A NULL pointer dereference flaw was found in 389-ds-base. This flaw oc ...)
 	TODO: check
 CVE-2026-116641 (The DB Tools rely on the TLS implementation in Golang\u2019s standard  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08898aea1eeec4ec20b8a0a5ebb8e5c5050d52cd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/08898aea1eeec4ec20b8a0a5ebb8e5c5050d52cd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/d349432c/attachment.htm>