[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 30 21:54:24 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8f323a85 by Moritz Muehlenhoff at 2026-10-30T22:54:09+01:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -13,7 +13,7 @@ CVE-2026-96894 (The ERP: Complete HR, Accounting & CRM Suite Built for WooCommer
CVE-2026-94175 (Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4. ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-93327 (A Deserialization of Untrusted Data vulnerability in the SubWorkflow t ...)
- TODO: check
+ NOT-FOR-US: Google Cloud
CVE-2026-91917 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
NOT-FOR-US: Dell / EMC
CVE-2026-91915 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
@@ -29,9 +29,9 @@ CVE-2026-90888 (Unauthenticated PHP Object Injection in LeadSnap <= 1.25 version
CVE-2026-87768 (DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via ...)
NOT-FOR-US: DateTime::Lite Perl module
CVE-2026-86715 (Plaintext storage of a password vulnerability in Crypttech Crypto and ...)
- TODO: check
+ NOT-FOR-US: Vatos DLP
CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handle ...)
- TODO: check
+ NOT-FOR-US: Google Cloud
CVE-2026-84243 (The gettext family of functions in the GNU C Library version 2.0 and l ...)
- glibc <unfixed>
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=17142
@@ -39,9 +39,9 @@ CVE-2026-84243 (The gettext family of functions in the GNU C Library version 2.0
CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22 through ...)
NOT-FOR-US: Teltonika Networks
CVE-2026-7004 (WIT SynApps Runtime through 1.4.11 contains a pre-authentication refle ...)
- TODO: check
+ NOT-FOR-US: WIT SynApps Runtime
CVE-2026-7003 (WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vu ...)
- TODO: check
+ NOT-FOR-US: WIT SynApps Runtime
CVE-2026-78527 (Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 ve ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery ...)
@@ -73,11 +73,11 @@ CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++. From
CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` dec ...)
TODO: check
CVE-2026-62264 (PDF Reader MCP is a Model Context Protocol server for reading PDF docu ...)
- TODO: check
+ NOT-FOR-US: PDF Reader MCP
CVE-2026-62162 (Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, ...)
- TODO: check
+ NOT-FOR-US: Hydra
CVE-2026-62160 (Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the globa ...)
- TODO: check
+ NOT-FOR-US: Daptin
CVE-2026-62141 (Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM f ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-62122 (Missing Authorization vulnerability in Arraytics Booktics booktics all ...)
@@ -97,7 +97,7 @@ CVE-2026-62023 (Missing Authorization vulnerability in Unlimited Elements Unlimi
CVE-2026-62019 (Missing Authorization vulnerability in Liquid Web / StellarWP BookIt b ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-61854 (VoiceSentinel is a real-time voice moderation system for Minecraft ser ...)
- TODO: check
+ NOT-FOR-US: VoiceSentinel
CVE-2026-61848 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
TODO: check
CVE-2026-61847 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
@@ -107,37 +107,37 @@ CVE-2026-61846 (Crass is a Ruby CSS parser that's fully compliant with the CSS S
CVE-2026-61845 (Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax ...)
TODO: check
CVE-2026-61840 (Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to ...)
- TODO: check
+ NOT-FOR-US: Quest Bot
CVE-2026-61826 (Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7 ...)
- TODO: check
+ NOT-FOR-US: Bazarr
CVE-2026-61806 (Frappe Learning Management System (LMS) is a learning system that help ...)
NOT-FOR-US: Frappe
CVE-2026-61805 (Frappe Learning Management System (LMS) is a learning system that help ...)
NOT-FOR-US: Frappe
CVE-2026-61804 (myTinyWMS is a free, open-source warehouse management system. Prior to ...)
- TODO: check
+ NOT-FOR-US: myTinyWMS
CVE-2026-61803 (Frappe Learning Management System (LMS) is a learning system that help ...)
NOT-FOR-US: Frappe
CVE-2026-61789 (DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle ...)
- TODO: check
+ NOT-FOR-US: DBHub
CVE-2026-61739 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: SOCFortress CoPilot
CVE-2026-61738 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: SOCFortress CoPilot
CVE-2026-61737 (ng-antd-admin is an Angular and NestJS administration system template. ...)
- TODO: check
+ NOT-FOR-US: ng-antd-admin
CVE-2026-61730 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: SOCFortress CoPilot
CVE-2026-61729 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
NOT-FOR-US: Wazuh
CVE-2026-61728 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: SOCFortress CoPilot
CVE-2026-61708 (SOCFortress CoPilot focuses on providing a single pane of glass for al ...)
- TODO: check
+ NOT-FOR-US: SOCFortress CoPilot
CVE-2026-61586 (Copernik XML Factory provides secure-by-default JAXP factory creation ...)
TODO: check
CVE-2026-59978 (AdminNeo is a full-featured database management tool written in PHP. F ...)
- TODO: check
+ NOT-FOR-US: AdminNeo
CVE-2026-59396 (A denial-of-service vulnerability exists in UAA's private_key_jwt clie ...)
TODO: check
CVE-2026-59388 (Cloud Controller (CAPI) leaks sensitive data into audit logs in multip ...)
@@ -149,7 +149,7 @@ CVE-2026-59386 (A SpaceSupporter could improperly modify an application's start
CVE-2026-59385 (A user with SpaceDeveloper privileges could modify the URL of a space- ...)
TODO: check
CVE-2026-55551 (ZAC is an open-source, workflow-based Common Ground component for Dutc ...)
- TODO: check
+ NOT-FOR-US: ZAC
CVE-2026-54855 (Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-54854 (Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.)
@@ -167,11 +167,11 @@ CVE-2026-49115
CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-48164 (Collabora Online is a collaborative online office suite based on Libre ...)
- TODO: check
+ NOT-FOR-US: Collabora Online
CVE-2026-46560 (Open Access Management (OpenAM) is an access management solution. Prio ...)
TODO: check
CVE-2026-46499 (Collabora Online is a collaborative online office suite based on Libre ...)
- TODO: check
+ NOT-FOR-US: Collabora Online
CVE-2026-45145 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
NOT-FOR-US: Chamilo LMS
CVE-2026-45144 (Chamilo LMS is an open-source learning management system. From 2.0.0 u ...)
@@ -231,7 +231,7 @@ CVE-2026-119777 (A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parse
NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241
NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c2690afec214d86ea5c054ca689fb7ee36980c45 (1.28.2)
CVE-2026-119764 (Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting ...)
- TODO: check
+ NOT-FOR-US: Mythic
CVE-2026-119763 (changelog.com before commit 7b35e829 contains a missing authorization ...)
NOT-FOR-US: changelog.com
CVE-2026-119762 (Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x b ...)
@@ -280,11 +280,11 @@ CVE-2026-119718 (Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buff
NOTE: https://projects.blender.org/blender/blender/commit/a0c62db3db61803f86e874bc05407890ce4a1e43 (v5.2.3)
NOTE: https://projects.blender.org/blender/blender/commit/4f8a3270213b1ee67b44fe122ace3debdec3de47 (v4.5.15)
CVE-2026-119717 (pybars4 through 0.9.13 contains a code injection vulnerability in pyba ...)
- TODO: check
+ NOT-FOR-US: pybars4
CVE-2026-119716 (pybars3 through 0.9.7 contains a code injection vulnerability in pybar ...)
- TODO: check
+ NOT-FOR-US: pybars3
CVE-2026-119715 (NocoDB before 2026.08.0 contains a clickjacking vulnerability that all ...)
- TODO: check
+ NOT-FOR-US: NocoDB
CVE-2026-119714 (My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode ...)
NOT-FOR-US: WordPress plugin
CVE-2026-119713 (Paperclip 2026.403.0 before 2026.416.0 contains a remote code executio ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8f323a857ab79ef90c755ed8b329761b2ce550c9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8f323a857ab79ef90c755ed8b329761b2ce550c9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/3d24d6c6/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list