[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 30 22:11:20 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fba19bf9 by Moritz Muehlenhoff at 2026-10-30T23:10:56+01:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -73,7 +73,7 @@ CVE-2026-62303 (Pistache is a high-performance REST toolkit written in C++. From
NOTE: https://github.com/pistacheio/pistache/security/advisories/GHSA-q474-pqcp-gqm5
NOTE: https://github.com/pistacheio/pistache/commit/935461352403696f3ca0dbb9a7de7d2609e7ce91
CVE-2026-62298 (mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` dec ...)
- TODO: check
+ NOT-FOR-US: asn1c
CVE-2026-62264 (PDF Reader MCP is a Model Context Protocol server for reading PDF docu ...)
NOT-FOR-US: PDF Reader MCP
CVE-2026-62162 (Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, ...)
@@ -179,7 +179,7 @@ CVE-2026-48201 (Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Mini
CVE-2026-48164 (Collabora Online is a collaborative online office suite based on Libre ...)
NOT-FOR-US: Collabora Online
CVE-2026-46560 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: Open Access Management (OpenAM)
CVE-2026-46499 (Collabora Online is a collaborative online office suite based on Libre ...)
NOT-FOR-US: Collabora Online
CVE-2026-45145 (Chamilo LMS is an open-source learning management system. Prior to 2.0 ...)
@@ -308,41 +308,41 @@ CVE-2026-119710 (PipesHub 0.3.0 before 0.10.0 contains an event type injection v
CVE-2026-119709 (Grimoire before 1.0.0 contains an unauthenticated server-side request ...)
TODO: check
CVE-2026-119708 (abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authoriza ...)
- TODO: check
+ NOT-FOR-US: abp-next-admin
CVE-2026-119707 (SonicJS through 3.0.0 contains a missing authorization vulnerability i ...)
- TODO: check
+ NOT-FOR-US: SonicJS
CVE-2026-119706 (InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated rem ...)
- TODO: check
+ NOT-FOR-US: InternLM LMDeploy
CVE-2026-119705 (SerpBear before 3.1.1 contains a missing authentication vulnerability ...)
- TODO: check
+ NOT-FOR-US: SerpBear
CVE-2026-119704 (Bastille through 1.4.4 contains a symlink following vulnerability in t ...)
- TODO: check
+ NOT-FOR-US: Bastille
CVE-2026-119703 (xiaozhi-esp32-server through 0.9.8 contains an authentication bypass v ...)
- TODO: check
+ NOT-FOR-US: xiaozhi-esp32-server
CVE-2026-119702 (WPGraphQL before 2.24.1 contains a missing authorization vulnerability ...)
- TODO: check
+ NOT-FOR-US: WPGraphQL
CVE-2026-119701 (WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability ...)
- TODO: check
+ NOT-FOR-US: WPGraphQL
CVE-2026-119700 (WPGraphQL before 2.24.2 contains an information disclosure vulnerabili ...)
- TODO: check
+ NOT-FOR-US: WPGraphQL
CVE-2026-119699 (WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource c ...)
- TODO: check
+ NOT-FOR-US: WPGraphQL
CVE-2026-119682 (An improper access control vulnerability exists in the multi-factor au ...)
- TODO: check
+ NOT-FOR-US: SharePoint Manager Plus
CVE-2026-119680 (A stored cross-site scripting (XSS) vulnerability exists in the chart ...)
- TODO: check
+ NOT-FOR-US: SharePoint Manager Plus
CVE-2026-119665 (WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnera ...)
- TODO: check
+ NOT-FOR-US: WHartTest
CVE-2026-119664 (Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization ...)
- TODO: check
+ NOT-FOR-US: Tamery (formerly Conar)
CVE-2026-119663 (Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authori ...)
- TODO: check
+ NOT-FOR-US: Tamery (formerly Conar)
CVE-2026-119662 (Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerab ...)
- TODO: check
+ NOT-FOR-US: Songloft
CVE-2026-119661 (ShowDoc through 3.9.5 contains an authorization bypass vulnerability i ...)
- TODO: check
+ NOT-FOR-US: ShowDoc
CVE-2026-119660 (MuseBot before 2.0.0 contains an authentication bypass vulnerability t ...)
- TODO: check
+ NOT-FOR-US: MuseBot
CVE-2026-119659 (Blossom through 1.17.1 contains an authorization bypass vulnerability ...)
TODO: check
CVE-2026-119658 (PowerDNS-Admin through 2026.08.1 contains an authorization bypass vuln ...)
@@ -358,19 +358,19 @@ CVE-2026-119654 (DataCap through 2025.1.1 contains a missing authorization vulne
CVE-2026-119653 (Nging through 5.3.5 contains an information disclosure vulnerability t ...)
TODO: check
CVE-2026-119652 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
- TODO: check
+ NOT-FOR-US: HuLa-Server
CVE-2026-119651 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
- TODO: check
+ NOT-FOR-US: HuLa-Server
CVE-2026-119650 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
- TODO: check
+ NOT-FOR-US: HuLa-Server
CVE-2026-119649 (Orchard CMS 1.10.3 through 1.11 contains an improper authorization vul ...)
- TODO: check
+ NOT-FOR-US: Orchard CMS
CVE-2026-119648 (Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing auth ...)
- TODO: check
+ NOT-FOR-US: Tencent
CVE-2026-119647 (RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: RuoYi-Vue-Plus
CVE-2026-119646 (Open Web Analytics before 1.14.1 contains an authorization vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Open Web Analytics
CVE-2026-119645 (ZenTao PMS through 22.6 contains a missing authorization vulnerability ...)
TODO: check
CVE-2026-119644 (Blossom through 1.17.1 contains an authorization bypass vulnerability ...)
@@ -406,11 +406,11 @@ CVE-2026-119576 (ArcadeDB from 21.12.1 before 26.10.2 contains an authorization
CVE-2026-119575 (ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request for ...)
TODO: check
CVE-2026-119574 (Traefik from 3.2.0 before 3.7.15 contains a data race in the experimen ...)
- TODO: check
+ - traefik <itp> (bug #983289)
CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the K ...)
- TODO: check
+ - traefik <itp> (bug #983289)
CVE-2026-119572 (Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypas ...)
- TODO: check
+ - traefik <itp> (bug #983289)
CVE-2026-119571 (Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorizati ...)
NOT-FOR-US: Parse Server
CVE-2026-119570 (Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information ...)
@@ -591,25 +591,25 @@ CVE-2026-119037 (Business::GoCardless versions before 1.01 for Perl accept forge
CVE-2026-119036 (Business::GoCardless versions before 1.01 for Perl allow memory exhaus ...)
TODO: check
CVE-2026-118996 (CallBackery versions before 0.62.0 for Perl send users their own passw ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118995 (CallBackery versions before 0.62.0 for Perl accept unintended values i ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118994 (CallBackery versions before 0.62.0 for Perl allow log injection via ne ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118993 (CallBackery versions before 0.62.0 for Perl allow denial of service vi ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118992 (CallBackery versions before 0.62.0 for Perl allow OS command execution ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118991 (CallBackery versions before 0.62.0 for Perl encrypt configuration back ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118990 (CallBackery versions before 0.62.0 for Perl leave a world-readable dum ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118988 (CallBackery versions before 0.60.1 for Perl let unauthenticated client ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118987 (CallBackery versions before 0.62.0 for Perl accept session cookies of ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118986 (CallBackery versions before 0.62.0 for Perl allow session cookie forge ...)
- TODO: check
+ NOT-FOR-US: CallBackery
CVE-2026-118697 (In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before ...)
TODO: check
CVE-2026-118696 (In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm b ...)
@@ -627,19 +627,19 @@ CVE-2026-118089 (Shop manager PHP Object Injection in Product Feed Manager <= 7.
CVE-2026-118086 (Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-117350 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
- TODO: check
+ - bitcoin <removed>
CVE-2026-117349 (Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OO ...)
- TODO: check
+ - bitcoin <removed>
CVE-2026-117346 (Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo ...)
- TODO: check
+ - bitcoin <removed>
CVE-2026-117184 (An issue in the GraphQL endpoint of traggo server v0.8.3 allows attack ...)
- TODO: check
+ NOT-FOR-US: traggo
CVE-2026-117183 (A path traversal vulnerability in the FeaturedImage component of astro ...)
- TODO: check
+ NOT-FOR-US: astro-notion-blog
CVE-2026-117182 (An authenticated cross-site scripting (XSS) vulnerability in the /spin ...)
- TODO: check
+ NOT-FOR-US: Spina CMS
CVE-2026-117028 (Skuul School Management System through version 2.6.5 is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: Skuul School Management System
CVE-2026-116862 (Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 ver ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116861 (Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 vers ...)
@@ -669,7 +669,7 @@ CVE-2026-116401 (Unauthenticated Broken Access Control in HUSKY <= 1.4.6 version
CVE-2026-116386 (Unauthenticated Privilege Escalation in SMS Alert Order Notifications ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-116366 (An issue has been discovered in ClickHouse Server that, under certain ...)
- TODO: check
+ - clickhouse <removed>
CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at a ...)
- libhttp-parser-xs-perl <unfixed> (bug #1152633)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44760361/
@@ -713,17 +713,17 @@ CVE-2026-114691 (A flaw was found in the libstdc++ component of GCC. An attacker
CVE-2026-114690 (A flaw was found in GCC. An out-of-bounds memory access vulnerability ...)
TODO: check
CVE-2026-112905 (Vvveb is a powerful and easy to use CMS with page builder to build web ...)
- TODO: check
+ NOT-FOR-US: Vvveb
CVE-2026-112816 (Improper certificate validation in the HTTPS listener in Canonical LXD ...)
TODO: check
CVE-2026-112374 (FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnera ...)
- TODO: check
+ NOT-FOR-US: FOSSBilling
CVE-2026-112365 (The easy.jobs \u2013 AI powered Job Listing, Job Board, Career Page, R ...)
NOT-FOR-US: WordPress plugin
CVE-2026-112348 (Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-112347 (Kirki plugin for WordPress before 6.4.1 contains a broken object-level ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111505 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
NOT-FOR-US: Dell / EMC
CVE-2026-111504 (Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Impro ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fba19bf9c1b80d4319c3fd1293809b8091e85849
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fba19bf9c1b80d4319c3fd1293809b8091e85849
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/4008f3c1/attachment.htm>
More information about the debian-security-tracker-commits
mailing list