[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 29 19:14:42 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
dc259f7e by security tracker role at 2026-10-29T19:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -7,23 +7,23 @@ CVE-2026-97860 (YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register
CVE-2026-97854 (Yamaha wireless LAN router NWR100 provided by Yamaha Corporation conta ...)
TODO: check
CVE-2026-97073 (Missing Authorization vulnerability in myCred myCred mycred allows Exp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96767 (The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress plugin for Wo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96203 (Use after free in Microsoft Edge (Chromium-based) allows an unauthoriz ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96199 (Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96198 (Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96196 (Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96192 (Use after free in Microsoft Edge for iOS allows an unauthorized attack ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-96187 (Access of resource using incompatible type ('type confusion') in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-93680 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-93571 (Szafir is vulnerable to Path Traversal in the uploaded filename. A man ...)
TODO: check
CVE-2026-93570 (Szafir and Szafir Weryfikuj\u0105ca are vulnerable to XML External Ent ...)
@@ -41,37 +41,37 @@ CVE-2026-93007 (A flaw was found in dnsmasq. The TCP DNS service uses a small fi
CVE-2026-93006 (A flaw was found in dnsmasq. The TFTP server can serve the wrong file ...)
TODO: check
CVE-2026-92086 (The MW WP Form plugin for WordPress is vulnerable to Sensitive Informa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91153 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91152 (The Everest Forms \u2013 Contact Form, Payment Form, Quiz, Survey & Cu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90991 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-90872 (Improper neutralization of directives in dynamically evaluated code in ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90871 (Improper limitation of a pathname to a restricted directory in Progres ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90870 (A missing release of backend receiver sessions in the Ad Hoc Transfer ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90869 (A remote attacker who knows a valid account's enrolled SSH public key ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90868 (An OS command injection vulnerability in Progress Software WS_FTP Serv ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90867 (Improper access control in the Web Admin console of Progress Software ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90866 (A path traversal vulnerability in Progress Software WS_FTP Server vers ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90865 (An OS command injection vulnerability in Progress Software WS_FTP Serv ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90864 (A path traversal vulnerability in Progress Software WS_FTP Server vers ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90863 (Missing authorization in the administrative interface of Progress Soft ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90862 (Improper authentication in the Web Transfer Module of Progress Softwar ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-90861 (Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0. ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-8824 (A memory corruption vulnerability exists in the vtkBMPReader ExecuteDa ...)
TODO: check
CVE-2026-8822 (A memory corruption vulnerability exists in the vtkDEMReader ReadProfi ...)
@@ -79,25 +79,25 @@ CVE-2026-8822 (A memory corruption vulnerability exists in the vtkDEMReader Read
CVE-2026-88941 (Kaspersky has fixed a vulnerability in the Network Agent for Windows m ...)
TODO: check
CVE-2026-88090 (Access of resource using incompatible type ('type confusion') in Micro ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-88078 (Improper verification of cryptographic signature in Microsoft Edge (Ch ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-88077 (Integer overflow or wraparound in Microsoft Edge (Chromium-based) allo ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85899 (Use after free in Microsoft Edge (Chromium-based) allows an authorized ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85897 (Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85890 (Double free in Microsoft Edge (Chromium-based) allows an unauthorized ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-85330 (Incorrect authorization in Microsoft Edge for Android allows an unauth ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-84296 (Multi-Factor Authentication Bypass vulnerability in SSH component in P ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-84295 (Improper authentication in Progress Software WS_FTP Server versions pr ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-84294 (Improper limitation of pathname in the Ad Hoc Transfer component of Pr ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-80069 (MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing ...)
TODO: check
CVE-2026-80067 (MasterStudy LMS plugin for WordPress before 3.7.50 contains a path tra ...)
@@ -107,73 +107,73 @@ CVE-2026-7190 (A cross-site scripting (XSS) vulnerability in the ICTBroadcast so
CVE-2026-79589 (The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an in ...)
TODO: check
CVE-2026-77819 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-77817 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-71569 (Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A c ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-6877 (ServiceNow has addressed a domain separation bypass security issue tha ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-66912 (Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-66911 (Zimbra is vulnerable to stored cross-site scripting (XSS) via the Cont ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-62374 (SD JWT JS is a JavaScript implementation of the Selective Disclosure J ...)
TODO: check
CVE-2026-62131 (Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62018 (Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62017 (Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62016 (Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62015 (Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62014 (Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62013 (Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62012 (Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62011 (Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62010 (Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62009 (Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62008 (Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62006 (Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62005 (Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62004 (Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62003 (Unauthenticated PHP Object Injection in Mission <= 1.22 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62002 (Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62001 (Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61998 (Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61997 (Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61996 (Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61995 (Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61993 (Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61992 (Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61991 (Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61989 (Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61988 (Unauthenticated Cross Site Scripting (XSS) in Auction Nudge \u2013 You ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-60111
REJECTED
CVE-2026-5702 (Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC applicatio ...)
@@ -193,35 +193,35 @@ CVE-2026-58119
CVE-2026-58118
REJECTED
CVE-2026-56056 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54871 (Missing Authorization vulnerability in Mamunur Rashid ShopBuilder \u20 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54866 (Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54865 (Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54864 (Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54862 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54860 (Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54859 (Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54858 (Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54857 (Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54856 (Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54853 (Missing Authorization vulnerability in Cozmoslabs Profile Builder prof ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54852 (Missing Authorization vulnerability in miniOrange Page Restriction Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52709 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52708 (Missing Authorization vulnerability in weDevs WP User Frontend wp-user ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-51912 (OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in ma ...)
TODO: check
CVE-2026-51905 (TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access ...)
@@ -235,87 +235,87 @@ CVE-2026-51863 (DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_exam
CVE-2026-51851 (modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directo ...)
TODO: check
CVE-2026-49142 (OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenEMR
CVE-2026-48884 (Missing Authorization vulnerability in weDevs WP User Frontend wp-user ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48202 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48200 (Insertion of Sensitive Information Into Sent Data vulnerability in Bar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48196 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48195 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42707 (Missing Authorization vulnerability in HivePress HivePress Claim Listi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42703 (Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42701 (Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42694 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42692 (Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42691 (Authorization Bypass Through User-Controlled Key vulnerability in Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42690 (Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-42057 (An invalid pointer dereference vulnerability exists in the vtkPNGReade ...)
TODO: check
CVE-2026-41216 (An invalid pointer dereference vulnerability exists in the vtkPNGReade ...)
TODO: check
CVE-2026-39782 (Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39742 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39741 (Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnst ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39737 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39736 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39735 (Missing Authorization vulnerability in Crocoblock JetEngine jet-engine ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-33924 (Two OS command injection vulnerabilities were discovered in the update ...)
TODO: check
CVE-2026-33923 (A signature verification vulnerability was discovered in the update in ...)
TODO: check
CVE-2026-27401 (Missing Authorization vulnerability in YITH YITH PayPal Express Checko ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27394 (Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27063 (Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27062 (Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25467 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25450 (Missing Authorization vulnerability in ThemeGrill User Registration us ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-25448 (Missing Authorization vulnerability in weDevs WP ERP erp allows Exploi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-24533 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-22386 (Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-port ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-20942 (Improper restriction of rendered ui layers or frames in Microsoft Edge ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-18894 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11587 (SQL injection allowing an authenticated user with access to ACL manage ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2026-119251 (A malicious actor with local access and high privileges could exploit ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119250 (A malicious actor with local access and low privileges could exploit a ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119249 (A malicious actor with access to the network could exploit a Binding t ...)
- TODO: check
+ NOT-FOR-US: Ubiquity
CVE-2026-119168 (HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink followi ...)
TODO: check
CVE-2026-119145 (Frappe before 15.121.0 and 16.x before 16.34.0 contains a path travers ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-119144 (Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a se ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-119143 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
TODO: check
CVE-2026-119142 (Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a deni ...)
@@ -351,9 +351,9 @@ CVE-2026-119128 (ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass v
CVE-2026-119127 (ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerabi ...)
TODO: check
CVE-2026-119126 (Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119125 (Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns th ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119124 (ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in i ...)
TODO: check
CVE-2026-119123 (ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in ...)
@@ -369,7 +369,7 @@ CVE-2026-119119 (Crawl4AI before 0.9.5 contains a denial of service vulnerabilit
CVE-2026-119118 (Crawl4AI before 0.9.5 contains an improper certificate validation vuln ...)
TODO: check
CVE-2026-119115 (Incorrect authorization in the issuer resolution logic in AWS Private ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119054 (Multiple Pages Generator by Themeisle before 4.2.5 contains a stored c ...)
TODO: check
CVE-2026-119053 (lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of- ...)
@@ -445,149 +445,149 @@ CVE-2026-118673 (KeePassXC is a cross-platform community-driven port of the Wind
CVE-2026-118425 (A flaw was found in the secure-redirect-uris-enforcer client policy of ...)
TODO: check
CVE-2026-118192 (The JoomSport \u2013 for Sports: Team & League, Football, Hockey & mor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118097 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118095 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118094 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118093 (Missing Authorization vulnerability in WPFunnels Team Product Feed Man ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118092 (Missing Authorization vulnerability in StylemixThemes MasterStudy LMS ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118091 (Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunn ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118088 (Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunn ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118087 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118085 (Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118084 (Subscriber Insecure Direct Object References (IDOR) in Hotel Booking < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118083 (Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118082 (Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118081 (Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118080 (Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118079 (Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118078 (Shop manager PHP Object Injection in Product Catalog Feed by PixelYour ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118077 (Author PHP Object Injection in Sastra Essential Addons for Elementor < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118076 (Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118075 (Contributor PHP Object Injection in WP Media folders <= 1.1.10 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118074 (Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118073 (Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-117611 (Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3. ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-117174
REJECTED
CVE-2026-116869 (Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116868 (Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Ty ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116867 (Contributor PHP Object Injection in Dynamic QR Code – generator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116866 (Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116865 (Editor PHP Object Injection in Zippy <= 1.7.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116864 (Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116857 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116856 (Missing Authorization vulnerability in WP Desk Flexible Quantity \u201 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116850 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116849 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116848 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116846 (Missing Authorization vulnerability in WP User Manager WP User Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116763 (The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116566 (socket.getaddrinfo() previously accepted null bytes within *host* and ...)
TODO: check
CVE-2026-116409 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116406 (Missing Authorization vulnerability in Webba Plugins Webba Booking web ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116402 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116399 (Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Con ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116387 (Missing Authorization vulnerability in Brainstorm Force SureForms sure ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115967 (Weak Authentication vulnerability in Hamid Alinia Login with phone num ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115965 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115964 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115963 (Missing Authorization vulnerability in VideoWhisper.com Broadcast Live ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115962 (Authentication Bypass by Spoofing vulnerability in myCred myCred mycre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115821 (The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115805 (Improper handling of local filesystem paths in Rapid7 Insight Agent on ...)
TODO: check
CVE-2026-115795 (P-Net before 1.0.3 does not check that a complete block header is pres ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115794 (P-Net before 1.0.3 passes the application alarm callback a data length ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115793 (P-Net before 1.0.3 does not release the RPC session allocated for an R ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-115713 (Improper Link Resolution Before File Access ('Link Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115712 (Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) ca ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115711 (Insertion of Sensitive Information into Externally-Accessible File or ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115709 (Improper Link Resolution Before File Access ('Link Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115708 (Improper Link Resolution Before File Access ('Link Following') (CWE-59 ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115707 (Insertion of Sensitive Information into Externally-Accessible File or ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115706 (Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic ...)
- TODO: check
+ NOT-FOR-US: Elastic
CVE-2026-115611 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115610 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115605 (Missing Authorization vulnerability in Brainstorm Force SureDash sured ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115601 (Missing Authorization vulnerability in WP Desk Custom Price for WooCom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115599 (Missing Authorization vulnerability in ThimPress LearnPress learnpress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115592 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115303 (The Contact Form by Supsystic WordPress plugin before 1.11.1 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-114706 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114358 (This vulnerability exists in the Radius Xenia M2M Platform due to insu ...)
TODO: check
CVE-2026-114193 (Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114181 (Missing Authorization vulnerability in Magepeople inc. Taxi Booking Ma ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114148 (Incorrect default permissions in ASP.NET Core allows an authorized att ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-113697 (Reflected cross-site scripting in the agent query feature of BMC Helix ...)
TODO: check
CVE-2026-113696 (Improper authorization in the SmartIT change approval feature of BMC I ...)
@@ -609,87 +609,87 @@ CVE-2026-113689 (Stored cross-site scripting in the SmartIT work-notes feature o
CVE-2026-113688 (Server-side request forgery in the SmartIT URL-based attachment featur ...)
TODO: check
CVE-2026-113576 (Adobe Digital Editions is affected by an Improper Limitation of a Path ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2026-112827 (Missing Authorization vulnerability in VillaTheme HANDMADE \u2013 Drop ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-112256 (Acceptance of extraneous untrusted data with trusted data vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-112255 (Initialization of a resource with an insecure default vulnerability in ...)
- TODO: check
+ NOT-FOR-US: OpenText
CVE-2026-112200 (P-Net before 1.0.3 does not release the Application Relationship (AR) ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111736 (P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_i ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111735 (P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind( ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111734 (P-Net before 1.0.3 does not validate the length of a received Ethernet ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111733 (P-Net before 1.0.3 dereferences a NULL AR pointer when handling an imp ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111732 (P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabl ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111731 (P-Net before 1.0.3 enters an infinite loop when handling a read reques ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111730 (P-Net before 1.0.3 does not validate the LengthPeerStationName field o ...)
- TODO: check
+ NOT-FOR-US: RT-Labs
CVE-2026-111419 (A sensitive information exposure vulnerability exists on the Foxit off ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111418 (A server-side request forgery (SSRF) vulnerability exists in the Foxit ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111417 (A broken access control vulnerability exists in the Foxit official web ...)
- TODO: check
+ NOT-FOR-US: Foxit
CVE-2026-111318 (The HT Mega Addons for Elementor \u2013 Elementor Widgets & Template B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110881 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-110707 (The RSS Aggregator by Feedzy \u2013 Feed to Post, Autoblogging, News & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110309 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110245 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110244 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110200 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110196 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker wi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110193 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker wi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110192 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110190 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated use ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110186 (IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-110184 (The Newsmatic theme for WordPress is vulnerable to blind SQL Injection ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109891 (Missing Authorization vulnerability in weDevs Happy Addons for Element ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-109822 (Yamaha wireless LAN router NWR100 provided by Yamaha Corporation conta ...)
TODO: check
CVE-2026-109216 (The Meta Box \u2013 A Framework for Dynamic Websites plugin for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109215 (The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-108494 (Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107743 (The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107629 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107627 (The Greenshift \u2013 animation and page builder blocks plugin for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107347 (HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink followi ...)
TODO: check
CVE-2026-107329 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107328 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107327 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107326 (IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-107060 (Insecure permissions in Tailscale versionCode 297862600 allows unautho ...)
TODO: check
CVE-2026-107059 (An issue in Nextcloud versionCode 30390190 allows attackers to force v ...)
@@ -781,59 +781,59 @@ CVE-2026-107014 (Insecure permissions in Bander Notepad (bander.notepad) version
CVE-2026-106036 (Szafir accepts any client or server certificate without performing cer ...)
TODO: check
CVE-2026-104727 (The Sequential Order Numbers for WooCommerce plugin for WordPress is v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104339 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104331 (IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side req ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104328 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104324 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104317 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker wh ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104316 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104315 (IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side req ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104314 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104312 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104310 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104309 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-104308 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-103875 (The Media Library Assistant plugin for WordPress is vulnerable to Refl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103665 (The installer for Yamaha LAN Monitor for Windows provided by Yamaha Co ...)
TODO: check
CVE-2026-103485 (The Extensions for Leaflet Map plugin for WordPress is vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103094 (ServiceNow has remediated an information disclosure vulnerability that ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-103093 (ServiceNow has remediated a sandbox escape security issue that was ide ...)
- TODO: check
+ NOT-FOR-US: ServiceNow
CVE-2026-103092 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102590 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-102260 (HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace ...)
TODO: check
CVE-2026-101288 (IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticat ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2025-62841 (An use of hard-coded cryptographic key vulnerability has been reported ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-62839 (An use of hard-coded cryptographic key vulnerability has been reported ...)
- TODO: check
+ NOT-FOR-US: QNAP
CVE-2025-13050 (Broken Function Level Authorization allows execution of poller post-re ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2025-12523 (Broken Object Level Authorization in Users Configuration Endpoint allo ...)
- TODO: check
+ NOT-FOR-US: Centreon
CVE-2023-7357 (A remote code execution (RCE) vulnerability was identified in the Flex ...)
- TODO: check
+ NOT-FOR-US: Flexera
CVE-2019-25781 (Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity ...)
TODO: check
CVE-2026-XXXX [GHSA-c968-33g3-wh7p: Package names in vendor/composer/installed.json can escape the vendor directory during install and reinstall]
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc259f7efba9dc269f346d03328f7afd257b3c43
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dc259f7efba9dc269f346d03328f7afd257b3c43
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/29fb4104/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list