[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 30 04:31:12 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3d20bd1b by Salvatore Bonaccorso at 2026-10-30T05:30:52+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -320,7 +320,7 @@ CVE-2026-66912 (Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via th
CVE-2026-66911 (Zimbra is vulnerable to stored cross-site scripting (XSS) via the Cont ...)
NOT-FOR-US: Zimbra
CVE-2026-62374 (SD JWT JS is a JavaScript implementation of the Selective Disclosure J ...)
- TODO: check
+ NOT-FOR-US: SD JWT JS
CVE-2026-62131 (Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62018 (Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.)
@@ -566,29 +566,29 @@ CVE-2026-119118 (Crawl4AI before 0.9.5 contains an improper certificate validati
CVE-2026-119115 (Incorrect authorization in the issuer resolution logic in AWS Private ...)
NOT-FOR-US: Amazon
CVE-2026-119054 (Multiple Pages Generator by Themeisle before 4.2.5 contains a stored c ...)
- TODO: check
+ NOT-FOR-US: Multiple Pages Generator
CVE-2026-119053 (lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of- ...)
TODO: check
CVE-2026-119052 (llama.cpp b2877 before b11935 contains an uncaught exception vulnerabi ...)
TODO: check
CVE-2026-119051 (flat through 6.0.1 contains an uncontrolled resource allocation vulner ...)
- TODO: check
+ NOT-FOR-US: flat Node.js module
CVE-2026-119050 (Agno through 3.1.11 contains an unsafe reflection vulnerability in Pan ...)
- TODO: check
+ NOT-FOR-US: Agno
CVE-2026-119049 (FreeMail before 5.3.2 contains an authorization bypass vulnerability t ...)
- TODO: check
+ NOT-FOR-US: FreeMail
CVE-2026-119048 (JeeSite 5.11.0 through 5.19.1 contains an insecure direct object refer ...)
- TODO: check
+ NOT-FOR-US: JeeSite
CVE-2026-119028 (oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: oapi-codegen (not same as golang-github-oapi-codegen-runtime, itp'ed)
CVE-2026-119027 (oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: oapi-codegen (not same as golang-github-oapi-codegen-runtime, itp'ed)
CVE-2026-119025 (open 7.2.0 before 11.0.0 contains an OS command injection vulnerabilit ...)
TODO: check
CVE-2026-118989 (WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 con ...)
- TODO: check
+ NOT-FOR-US: WooCommerce
CVE-2026-118984 (OmniRoute 3.8.0 before 3.8.52 contains an unverified password change v ...)
- TODO: check
+ NOT-FOR-US: OmniRoute
CVE-2026-118782 (Forge (also called node-forge) is a native implementation of Transport ...)
TODO: check
CVE-2026-118781 (Forge (also called node-forge) is a native implementation of Transport ...)
@@ -610,7 +610,7 @@ CVE-2026-118774 (Forge (also called node-forge) is a native implementation of Tr
CVE-2026-118773 (Glob matches files using patterns the shell uses. From 9.0.0 until 14. ...)
TODO: check
CVE-2026-118772 (joi is a schema description language and data validator for JavaScript ...)
- TODO: check
+ NOT-FOR-US: Node joi
CVE-2026-118769 (Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Bota ...)
TODO: check
CVE-2026-118768 (Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the bo ...)
@@ -624,17 +624,17 @@ CVE-2026-118765 (Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, a
CVE-2026-118764 (minimatch is a minimal matching utility for converting glob expression ...)
TODO: check
CVE-2026-118763 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
- TODO: check
+ NOT-FOR-US: sigstore-js
CVE-2026-118762 (Monkeytype is a minimalistic and customizable typing test. Prior to 26 ...)
- TODO: check
+ NOT-FOR-US: Monkeytype
CVE-2026-118761 (Kubeflow Pipelines enables users to build and deploy portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118760 (Kubeflow Pipelines enables users to build and deploy portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118759 (Kubeflow Pipelines enables users to build and deploy portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118758 (Kubeflow Pipelines enables users to build and deploy portable, scalabl ...)
- TODO: check
+ NOT-FOR-US: Kubeflow Pipelines
CVE-2026-118673 (KeePassXC is a cross-platform community-driven port of the Windows app ...)
TODO: check
CVE-2026-118425 (A flaw was found in the secure-redirect-uris-enforcer client policy of ...)
@@ -1201,57 +1201,57 @@ CVE-2026-11854 (The authentication endpoint generates an error message that incl
CVE-2026-118905 (Node Version Manager (nvm) is a POSIX-compliant shell function for man ...)
TODO: check
CVE-2026-118804 (Bricks Builder 2.4.3 and before contains a broken access control vulne ...)
- TODO: check
+ NOT-FOR-US: Bricks Builder
CVE-2026-118803 (Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data ...)
- TODO: check
+ NOT-FOR-US: Bricks Theme
CVE-2026-118757 (PiWeb Disable payment method / Partial payment for WooCommerce before ...)
- TODO: check
+ NOT-FOR-US: WooCommerce
CVE-2026-118756 (gopass before 1.17.0 contains a path traversal vulnerability in the fi ...)
TODO: check
CVE-2026-118755 (Volmarg Personal Management System through 2.1.0 contains an OS comman ...)
- TODO: check
+ NOT-FOR-US: Volmarg Personal Management System
CVE-2026-118754 (Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulner ...)
NOT-FOR-US: Dolibarr
CVE-2026-118753 (FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflo ...)
- TODO: check
+ NOT-FOR-US: FreeImage (danoli3 fork)
CVE-2026-118752 (FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflo ...)
- TODO: check
+ NOT-FOR-US: FreeImage (danoli3 fork)
CVE-2026-118694 (python-markdown2 through 2.5.5 contains a denial of service vulnerabil ...)
TODO: check
CVE-2026-118693 (CherryTree through 1.7.2 contains a path traversal vulnerability in Ct ...)
- TODO: check
+ NOT-FOR-US: CherryTree
CVE-2026-118692 (CherryTree through 1.7.2 contains an OS command injection vulnerabilit ...)
- TODO: check
+ NOT-FOR-US: CherryTree
CVE-2026-118691 (xianyu-auto-reply-fix through 2.0.7 contains a missing authorization v ...)
- TODO: check
+ NOT-FOR-US: xianyu-auto-reply-fix
CVE-2026-118690 (Signal K Server before 2.33.0 contains a missing authentication vulner ...)
- TODO: check
+ NOT-FOR-US: Signal K Server
CVE-2026-118689 (OvenMediaEngine through 0.21.0 contains a denial of service vulnerabil ...)
- TODO: check
+ NOT-FOR-US: OvenMediaEngine
CVE-2026-118682 (KaringX ClashMi through 1.0.32.1801 disables TLS certificate validatio ...)
- TODO: check
+ NOT-FOR-US: KaringX ClashMi
CVE-2026-118669 (OAuthLib is an implementation of the OAuth request-signing logic for P ...)
TODO: check
CVE-2026-118668 (langgraph-api implements the LangGraph API for rapid development and t ...)
- TODO: check
+ NOT-FOR-US: langgraph-api
CVE-2026-118667 (LangGraph Python SDK is used to connect to running LangGraph API serve ...)
- TODO: check
+ NOT-FOR-US: LangGraph Python SDK
CVE-2026-118666 (GraphQL Tools provides utilities for building, stitching, and mocking ...)
- TODO: check
+ NOT-FOR-US: GraphQL Tools
CVE-2026-118665 (GraphQL Tools provides utilities for building, stitching, and mocking ...)
- TODO: check
+ NOT-FOR-US: GraphQL Tools
CVE-2026-118664 (decode-uri-component provides a more robust alternative to decodeURICo ...)
- TODO: check
+ NOT-FOR-US: decode-uri-component
CVE-2026-118663 (@hono/node-server allows running the Hono application on Node.js. From ...)
- TODO: check
+ NOT-FOR-US: Hono node-server
CVE-2026-118662 (Vite is a frontend tooling framework for JavaScript. From 6.4.4 until ...)
TODO: check
CVE-2026-118661 (Happy DOM is a JavaScript implementation of a web browser without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118660 (Happy DOM is a JavaScript implementation of a web browser without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser without its ...)
- TODO: check
+ NOT-FOR-US: Happy DOM
CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d20bd1bf0809302f69a6e8b0048e7ca4644400a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d20bd1bf0809302f69a6e8b0048e7ca4644400a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/a4890c87/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list