[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Fri Oct 30 20:32:49 GMT 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9af7269b by Moritz Muehlenhoff at 2026-10-30T21:32:04+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -191,31 +191,31 @@ CVE-2026-39732 (Unauthenticated SQL Injection in Transliterator <= 2.5.13 versio
 CVE-2026-39375 (Frappe Learning Management System (LMS) is a learning system that help ...)
 	NOT-FOR-US: Frappe
 CVE-2026-37468 (Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11 ...)
-	TODO: check
+	NOT-FOR-US: MyBeeHome
 CVE-2026-28160 (Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 ver ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-27061 (Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 ve ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-22114 (HTTP basic auth enforces no retry limit or backoff. Combined with the  ...)
-	TODO: check
+	NOT-FOR-US: Delta UFC500
 CVE-2026-22110 (The web server does not check authentication on POST or PUT. An unauth ...)
-	TODO: check
+	NOT-FOR-US: Delta UFC500
 CVE-2026-22109 (The shipped WebUI template database retains the factory default passwo ...)
-	TODO: check
+	NOT-FOR-US: Delta UFC500
 CVE-2026-22105 (Delta UFC500 charging stations derive the default credentials of the S ...)
-	TODO: check
+	NOT-FOR-US: Delta UFC500
 CVE-2026-14467 (An information disclosure vulnerability in the Forocoches comments edi ...)
-	TODO: check
+	NOT-FOR-US: Forocoches
 CVE-2026-13747 (The Meow Gallery plugin for WordPress is vulnerable to authorization b ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-13576 (CallBackery versions before 0.62.0 for Perl store user passwords as un ...)
-	TODO: check
+	NOT-FOR-US: CallBackery
 CVE-2026-120046 (Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Nezha
 CVE-2026-120007 (NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerab ...)
-	TODO: check
+	NOT-FOR-US: NodeBB
 CVE-2026-119979 (LM Studio before 0.4.22+1 contains a path traversal vulnerability in t ...)
-	TODO: check
+	NOT-FOR-US: LM Studio
 CVE-2026-119978 (Flowise through 3.1.4 contains a sandbox escape vulnerability that all ...)
 	NOT-FOR-US: Flowise
 CVE-2026-119842 (A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle par ...)
@@ -225,11 +225,11 @@ CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parse
 CVE-2026-119764 (Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting  ...)
 	TODO: check
 CVE-2026-119763 (changelog.com before commit 7b35e829 contains a missing authorization  ...)
-	TODO: check
+	NOT-FOR-US: changelog.com
 CVE-2026-119762 (Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x b ...)
-	TODO: check
+	NOT-FOR-US: Axigen Mail Server
 CVE-2026-119761 (Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored ...)
-	TODO: check
+	NOT-FOR-US: Axigen Mail Server
 CVE-2026-119760 (sniproxy through 0.7.0 contains a NULL pointer dereference vulnerabili ...)
 	TODO: check
 CVE-2026-119729 (A flaw was found in GStreamer. An integer overflow vulnerability in th ...)
@@ -272,15 +272,15 @@ CVE-2026-119716 (pybars3 through 0.9.7 contains a code injection vulnerability i
 CVE-2026-119715 (NocoDB before 2026.08.0 contains a clickjacking vulnerability that all ...)
 	TODO: check
 CVE-2026-119714 (My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-119713 (Paperclip 2026.403.0 before 2026.416.0 contains a remote code executio ...)
-	TODO: check
+	NOT-FOR-US: Paperclip
 CVE-2026-119712 (PipesHub before 0.10.0 contains a server-side request forgery vulnerab ...)
-	TODO: check
+	NOT-FOR-US: PipesHub
 CVE-2026-119711 (PipesHub before 0.10.0 contains a rate limit bypass vulnerability in g ...)
-	TODO: check
+	NOT-FOR-US: PipesHub
 CVE-2026-119710 (PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerab ...)
-	TODO: check
+	NOT-FOR-US: PipesHub
 CVE-2026-119709 (Grimoire before 1.0.0 contains an unauthenticated server-side request  ...)
 	TODO: check
 CVE-2026-119708 (abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authoriza ...)
@@ -414,7 +414,7 @@ CVE-2026-119560 (OPNsense core through 26.7.8 contains a configuration injection
 CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerab ...)
 	TODO: check
 CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic vulnerability that  ...)
-	TODO: check
+	NOT-FOR-US: OpenCart
 CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability ...)
 	NOT-FOR-US: n8n
 CVE-2026-119556 (Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8 ...)
@@ -426,7 +426,7 @@ CVE-2026-119554 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 t
 CVE-2026-119553 (Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through  ...)
 	- moodle <removed>
 CVE-2026-119552 (Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO f ...)
-	TODO: check
+	NOT-FOR-US: Uptime Kuma
 CVE-2026-119551 (Jellyfin through 12.4 contains an authorization bypass vulnerability i ...)
 	- jellyfin-server <itp> (bug #994189)
 CVE-2026-119550 (Jellyfin through 12.4 contains an information disclosure vulnerability ...)
@@ -465,31 +465,31 @@ CVE-2026-119427 (phpMyAdmin through 5.2.3 contains an sql injection vulnerabilit
 CVE-2026-119426 (phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnera ...)
 	TODO: check
 CVE-2026-119425 (OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass  ...)
-	TODO: check
+	NOT-FOR-US: OPNsense
 CVE-2026-119424 (OPNsense core before 26.7.8 contains a configuration line injection vu ...)
-	TODO: check
+	NOT-FOR-US: OPNsense
 CVE-2026-119423 (OPNsense core before 26.7.8 contains a log injection vulnerability tha ...)
-	TODO: check
+	NOT-FOR-US: OPNsense
 CVE-2026-119422 (Juspay Hyperswitch before 1.128.0 contains an authentication bypass vu ...)
-	TODO: check
+	NOT-FOR-US: Juspay Hyperswitch
 CVE-2026-119421 (Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) co ...)
-	TODO: check
+	NOT-FOR-US: Juspay Hyperswitch
 CVE-2026-119420 (Lago through 1.55.0 contains an authentication bypass vulnerability th ...)
 	TODO: check
 CVE-2026-119419 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
-	TODO: check
+	- cakephp <removed>
 CVE-2026-119418 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
-	TODO: check
+	- cakephp <removed>
 CVE-2026-119417 (CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5. ...)
-	TODO: check
+	- cakephp <removed>
 CVE-2026-119416 (CakePHP through 5.4.3 contains an improper cookie domain validation vu ...)
-	TODO: check
+	- cakephp <removed>
 CVE-2026-119415 (CakePHP through 5.4.3 contains a header injection vulnerability in For ...)
-	TODO: check
+	- cakephp <removed>
 CVE-2026-119414 (Bitwarden Server before 2026.10.1 on Entity Framework backends contain ...)
-	TODO: check
+	- bitwarden <itp> (bug #956836)
 CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection vulnerability that ...)
-	TODO: check
+	NOT-FOR-US: OPNsense
 CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains ...)
 	NOT-FOR-US: n8n
 CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest credential ...)
@@ -6632,7 +6632,7 @@ CVE-2026-116680 (HomeBox is a home inventory and organization system. Prior to v
 CVE-2026-116679 (Neko is a a self-hosted virtual browser that runs in Docker and uses W ...)
 	TODO: check
 CVE-2026-116678 (Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to ...)
-	TODO: check
+	- vaultwarden <itp> (bug #1067023)
 CVE-2026-116677 (OpenWISP Controller is a network and WiFi controller for provisioning, ...)
 	TODO: check
 CVE-2026-116676 (Atlantis is a self-hosted golang application that listens for Terrafor ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9af7269b79f426cdc05946f726fb9a9c6284160f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9af7269b79f426cdc05946f726fb9a9c6284160f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/595781d4/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list