[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 30 19:16:21 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ddf5bbc4 by security tracker role at 2026-10-30T19:16:14+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,27 +1,27 @@
CVE-2026-9239 (The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97638 (The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97209 (Insecure Temporary File vulnerability in Mix deps.partition in Elixir ...)
TODO: check
CVE-2026-96894 (The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94175 (Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93327 (A Deserialization of Untrusted Data vulnerability in the SubWorkflow t ...)
TODO: check
CVE-2026-91917 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91915 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91914 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authe ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91913 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-91912 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use o ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-90888 (Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-87768 (DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via ...)
TODO: check
CVE-2026-86715 (Plaintext storage of a password vulnerability in Crypttech Crypto and ...)
@@ -31,37 +31,37 @@ CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/
CVE-2026-84243 (The gettext family of functions in the GNU C Library version 2.0 and l ...)
TODO: check
CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22 through ...)
- TODO: check
+ NOT-FOR-US: Teltonika Networks
CVE-2026-7004 (WIT SynApps Runtime through 1.4.11 contains a pre-authentication refle ...)
TODO: check
CVE-2026-7003 (WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vu ...)
TODO: check
CVE-2026-78527 (Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint Encryption a ...)
TODO: check
CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage query engine ...)
TODO: check
CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based) allows an a ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-66026
REJECTED
CVE-2026-66025
REJECTED
CVE-2026-65874 (This issue affects Apache Fineract versions up to and including 1.15.0 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65566 (Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-65444 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-64860
REJECTED
CVE-2026-64618 (Improper Neutralization of Special Elements used in an SQL Command ("S ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++. From 0.0.5 ...)
TODO: check
CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` dec ...)
@@ -73,23 +73,23 @@ CVE-2026-62162 (Hydra is a layer-two scalability solution for Cardano. Prior to
CVE-2026-62160 (Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the globa ...)
TODO: check
CVE-2026-62141 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62122 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62121 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62057 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62056 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62055 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62047 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62023 (Missing Authorization vulnerability in Unlimited Elements Unlimited El ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62019 (Missing Authorization vulnerability in Liquid Web / StellarWP BookIt b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61854 (VoiceSentinel is a real-time voice moderation system for Minecraft ser ...)
TODO: check
CVE-2026-61848 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
@@ -105,13 +105,13 @@ CVE-2026-61840 (Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `ima
CVE-2026-61826 (Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7 ...)
TODO: check
CVE-2026-61806 (Frappe Learning Management System (LMS) is a learning system that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61805 (Frappe Learning Management System (LMS) is a learning system that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61804 (myTinyWMS is a free, open-source warehouse management system. Prior to ...)
TODO: check
CVE-2026-61803 (Frappe Learning Management System (LMS) is a learning system that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-61789 (DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle ...)
TODO: check
CVE-2026-61739 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
@@ -123,7 +123,7 @@ CVE-2026-61737 (ng-antd-admin is an Angular and NestJS administration system tem
CVE-2026-61730 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
TODO: check
CVE-2026-61729 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: Wazuh
CVE-2026-61728 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
TODO: check
CVE-2026-61708 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
@@ -145,13 +145,13 @@ CVE-2026-59385 (A user with SpaceDeveloper privileges could modify the URL of a
CVE-2026-55551 (ZAC is an open-source, workflow-based Common Ground component for Dutc ...)
TODO: check
CVE-2026-54855 (Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54854 (Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-54850 (Subscriber Broken Access Control in Booking and Rental Manager <= 2.8. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-52710 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-50000 (SecureDrop is an open-source whistleblower submission system that medi ...)
TODO: check
CVE-2026-49116
@@ -159,7 +159,7 @@ CVE-2026-49116
CVE-2026-49115
REJECTED
CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-48164 (Collabora Online is a collaborative online office suite based on Libre ...)
TODO: check
CVE-2026-46560 (Open Access Management (OpenAM) is an access management solution. Prio ...)
@@ -167,31 +167,31 @@ CVE-2026-46560 (Open Access Management (OpenAM) is an access management solution
CVE-2026-46499 (Collabora Online is a collaborative online office suite based on Libre ...)
TODO: check
CVE-2026-45145 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-45144 (Chamilo LMS is an open-source learning management system. From 2.0.0 u ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-45141 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-44344 (Chamilo LMS is an open-source learning management system. In the 1.x l ...)
- TODO: check
+ NOT-FOR-US: Chamilo LMS
CVE-2026-39786 (Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39739 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39738 (Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39734 (Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39732 (Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-39375 (Frappe Learning Management System (LMS) is a learning system that help ...)
- TODO: check
+ NOT-FOR-US: Frappe
CVE-2026-37468 (Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11 ...)
TODO: check
CVE-2026-28160 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27061 (Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-22114 (HTTP basic auth enforces no retry limit or backoff. Combined with the ...)
TODO: check
CVE-2026-22110 (The web server does not check authentication on POST or PUT. An unauth ...)
@@ -203,7 +203,7 @@ CVE-2026-22105 (Delta UFC500 charging stations derive the default credentials of
CVE-2026-14467 (An information disclosure vulnerability in the Forocoches comments edi ...)
TODO: check
CVE-2026-13747 (The Meow Gallery plugin for WordPress is vulnerable to authorization b ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13576 (CallBackery versions before 0.62.0 for Perl store user passwords as un ...)
TODO: check
CVE-2026-120046 (Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerabi ...)
@@ -213,7 +213,7 @@ CVE-2026-120007 (NodeBB 1.18.0 through 4.16.5 contains an authorization bypass v
CVE-2026-119979 (LM Studio before 0.4.22+1 contains a path traversal vulnerability in t ...)
TODO: check
CVE-2026-119978 (Flowise through 3.1.4 contains a sandbox escape vulnerability that all ...)
- TODO: check
+ NOT-FOR-US: Flowise
CVE-2026-119842 (A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle par ...)
TODO: check
CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When ...)
@@ -367,11 +367,11 @@ CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an authorization bypass i
CVE-2026-119572 (Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypas ...)
TODO: check
CVE-2026-119571 (Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorizati ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119570 (Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119569 (Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-119568 (vsftpd through 3.0.5 contains an authentication bypass vulnerability i ...)
TODO: check
CVE-2026-119567 (vsftpd through 3.0.5 contains an access control bypass vulnerability t ...)
@@ -395,7 +395,7 @@ CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass v
CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic vulnerability that ...)
TODO: check
CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-119556 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8 ...)
TODO: check
CVE-2026-119555 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8 ...)
@@ -425,13 +425,13 @@ CVE-2026-119542 (A flaw was found in the Ickle query parser in Infinispan. A que
CVE-2026-119528 (A flaw was found in GIMP. The PSD plug-in\u2019s image resource header ...)
TODO: check
CVE-2026-119526 (Deserialization of Untrusted Data vulnerability in ThemeREX Royal Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119482 (Missing Authorization vulnerability in Crocoblock JetFormBuilder jetfo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119479 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119466 (Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExpert ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119429 (phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerab ...)
TODO: check
CVE-2026-119428 (phpMyAdmin through 5.2.3 contains a server-side request forgery vulner ...)
@@ -467,7 +467,7 @@ CVE-2026-119414 (Bitwarden Server before 2026.10.1 on Entity Framework backends
CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection vulnerability that ...)
TODO: check
CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains ...)
- TODO: check
+ NOT-FOR-US: n8n
CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest credential ...)
TODO: check
CVE-2026-119379 (SQLite before 3.54.0 built with the session extension contains a heap ...)
@@ -489,15 +489,15 @@ CVE-2026-119372 (SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS
CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion vulnerability that al ...)
TODO: check
CVE-2026-119370 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119369 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119368 (Missing Authorization vulnerability in Liquid Web / StellarWP The Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119367 (Missing Authorization vulnerability in Liquid Web / StellarWP The Even ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link ...)
TODO: check
CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to 11.11, the use ...)
@@ -517,21 +517,21 @@ CVE-2026-119288 (Zuke is a code-first, strongly typed build automation system fo
CVE-2026-119287 (Zuke is a code-first, strongly typed build automation system for Deno. ...)
TODO: check
CVE-2026-119176 (The CP Multi View Events Calendar plugin for WordPress is vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119148 (Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0. ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119147 (ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass i ...)
TODO: check
CVE-2026-119146 (ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnera ...)
TODO: check
CVE-2026-119117 (Insertion of sensitive information into a log file in Amazon Kinesis P ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119116 (A use-after-free and double-free issue in the SetClient command handle ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119113 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119086 (Missing queue-set type validation in the queue-set selection system ca ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-119038 (Business::GoCardless versions before 1.01 for Perl complete redirect f ...)
TODO: check
CVE-2026-119037 (Business::GoCardless versions before 1.01 for Perl accept forged webho ...)
@@ -563,17 +563,17 @@ CVE-2026-118697 (In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA
CVE-2026-118696 (In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm b ...)
TODO: check
CVE-2026-118635 (The The GeoDirectory \u2013 WP Business Directory Plugin and Classifie ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118238 (The Tenda W18E web management server is vulnerable to OS command injec ...)
- TODO: check
+ NOT-FOR-US: Tenda
CVE-2026-118205 (The Essential Addons for Elementor \u2013 Popular Elementor Templates ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118090 (Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118089 (Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-118086 (Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-117350 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
TODO: check
CVE-2026-117349 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
@@ -589,33 +589,33 @@ CVE-2026-117182 (An authenticated cross-site scripting (XSS) vulnerability in th
CVE-2026-117028 (Skuul School Management System through version 2.6.5 is vulnerable to ...)
TODO: check
CVE-2026-116862 (Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116861 (Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116860 (Missing Authorization vulnerability in Arraytics Timetics timetics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116854 (Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116853 (Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116852 (Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116851 (Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116847 (Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116552 (The Like Button Rating \u2665 LikeBtn plugin for WordPress is vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116410 (Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116407 (Missing Authorization vulnerability in Webba Plugins Webba Booking web ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116405 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116401 (Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116386 (Unauthenticated Privilege Escalation in SMS Alert Order Notifications ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-116366 (An issue has been discovered in ClickHouse Server that, under certain ...)
TODO: check
CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at a ...)
@@ -625,27 +625,27 @@ CVE-2026-116128 (Starlet versions from 0.20 before 0.33 for Perl allow memory ex
CVE-2026-116127 (Starlet versions before 0.33 for Perl send a body in responses to HEAD ...)
TODO: check
CVE-2026-115947 (Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115869 (The Themify Builder plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115866 (Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion v ...)
TODO: check
CVE-2026-115865 (Starlet versions before 0.33 for Perl allow a request declaring a larg ...)
TODO: check
CVE-2026-115820 (The Majestic Support \u2013 The Leading-Edge Help Desk & Customer Supp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115604 (Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-115456 (A flaw was found in gcc. An attacker could cause a Denial of Service ( ...)
TODO: check
CVE-2026-115455 (A flaw was found in GCC libstdc++. When an application extracts data i ...)
TODO: check
CVE-2026-115346 (The Avada | Website Builder For WordPress & WooCommerce theme for Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115274 (Improper Validation of Specified Quantity in Input vulnerability in th ...)
TODO: check
CVE-2026-114711 (Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An attacker who ca ...)
TODO: check
CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access vulnerability ...)
@@ -657,27 +657,27 @@ CVE-2026-112816 (Improper certificate validation in the HTTPS listener in Canoni
CVE-2026-112374 (FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnera ...)
TODO: check
CVE-2026-112365 (The easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, R ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112348 (Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vu ...)
TODO: check
CVE-2026-112347 (Kirki plugin for WordPress before 6.4.1 contains a broken object-level ...)
TODO: check
CVE-2026-111505 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111504 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111503 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111502 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insuf ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111501 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111500 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missin ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111499 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incor ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111498 (OpenManage Enterprise, versions prior to 4.8.0, contains an Improper R ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-111487 (An out-of-bounds write vulnerability in the Qt Framework assimp scene ...)
TODO: check
CVE-2026-110972 (P\u0142atnik performs client-side authentication. An attacker with acc ...)
@@ -689,41 +689,41 @@ CVE-2026-110970 (P\u0142atnikuses HTTP protocol to downloadupdates, libraries an
CVE-2026-110799 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
TODO: check
CVE-2026-110533 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110305 (The Advanced Custom Fields: Extended plugin for WordPress is vulnerabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110001 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109984 (The FV Flowplayer Video Player plugin for WordPress is vulnerable to S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109821 (Improper Validation of Specified Quantity in Input vulnerability in th ...)
TODO: check
CVE-2026-109592 (The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107868 (Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-O ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and WooComme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue to JSON ...)
TODO: check
CVE-2026-105894 (The Ak Framework plugin for WordPress, included in the Newsy - Viral N ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105456 (RTIR extends RT's HTML scrubber to allow an internal link placeh ...)
TODO: check
CVE-2026-105455 (RTIR's ticket creation forms show the subject of the related tic ...)
TODO: check
CVE-2026-105077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104744 (The Independent Analytics Pro plugin for WordPress is vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104739 (The JS Help Desk \u2013 AI-Powered Support & Ticketing System plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104674 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104623 (A security vulnerability exists in the authorization handling for the ...)
- TODO: check
+ NOT-FOR-US: SuSE software not packaged in Debian
CVE-2026-104615 (A security vulnerability was discovered in SUSE Rancher Fleet's cluste ...)
- TODO: check
+ NOT-FOR-US: SuSE software not packaged in Debian
CVE-2026-104067 (Scribus before 1.6.7 contains an out-of-bounds memory access vulnerabi ...)
TODO: check
CVE-2026-104066 (Scribus before 1.6.7 contains a heap buffer overflow vulnerability in ...)
@@ -739,21 +739,21 @@ CVE-2026-104062 (Scribus before 1.6.7 contains a heap buffer overflow vulnerabil
CVE-2026-104061 (Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability ...)
TODO: check
CVE-2026-102918 (The Redux Framework plugin for WordPress is vulnerable to Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-102905 (The The Ad Inserter \u2013 Ad Manager & AdSense Ads plugin for WordPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101214 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101213 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101210 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-101209 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-100355 (Campfire is a web-based chat application. In version 1.4.4 and earlier ...)
TODO: check
CVE-2025-8574 (The Database Cleaner plugin for WordPress is vulnerable to arbitrary t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-68395 (ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor ...)
TODO: check
CVE-2025-68394 (ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL ...)
@@ -767,11 +767,11 @@ CVE-2025-68391 (ARKETEAM Protectel modulesPROTECTELMAJ andBDF are vulnerable to
CVE-2025-49602 (An issue was discovered in Keyfactor EJBCA 9. When an administrator is ...)
TODO: check
CVE-2025-31704 (A vulnerability has been found in the Dahua Intelligent Connection Cen ...)
- TODO: check
+ NOT-FOR-US: Dahua
CVE-2015-20130 (Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected c ...)
TODO: check
CVE-2010-20125 (DedeCMS before 5.7 contains a file inclusion vulnerability in plus/car ...)
- TODO: check
+ NOT-FOR-US: DedeCMS
CVE-2026-97645 (The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-S ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96389 (Missing Authorization vulnerability in Drupal Xray Audit allows Forcef ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddf5bbc44ce993c652580148d7a624614dfe5737
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddf5bbc44ce993c652580148d7a624614dfe5737
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/bced573c/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list