[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 31 07:20:58 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ea3bfe08 by security tracker role at 2026-10-31T07:14:35+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,17 +1,17 @@
CVE-2026-95673
REJECTED
CVE-2026-94361 (The Payable Payment Gateway for WooCommerce WordPress plugin before 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92294 (The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Edit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90960 (The Seraphinite Accelerator plugin for WordPress is vulnerable to Sens ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89270 (The Popup Builder \u2013 Create highly converting, mobile friendly mar ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88942 (The Product Filter for WooCommerce by WBW plugin for WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82214 (The Quick Event Manager WordPress plugin before 9.19 does not verify t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-7005 (WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-o ...)
TODO: check
CVE-2026-78403 (Stack-based buffer overflow and missing authorization vulnerability in ...)
@@ -19,7 +19,7 @@ CVE-2026-78403 (Stack-based buffer overflow and missing authorization vulnerabil
CVE-2026-78402 (Stack-based buffer overflow and out-of-bounds write vulnerability in T ...)
TODO: check
CVE-2026-77152 (Improper Authorization vulnerability in Drupal Field Collection for Dr ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-63414 (Shopify App is a Rails engine for building Shopify applications. From ...)
TODO: check
CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for Ruby. In a ...)
@@ -163,15 +163,15 @@ CVE-2026-40573 (NovumOS is a custom 32-bit operating system written in Zig and x
CVE-2026-16760 (In Trail of Bits fickling through 0.1.12, the _process_import() method ...)
TODO: check
CVE-2026-120040 (The Mail logging & Catcher plugin for WordPress is vulnerable to Sensi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-120019 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-11396 (The Product Filter for WooCommerce by WBW plugin for WordPress is vuln ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119980 (The UsersWP \u2013 Front-end login form, User Registration, User Profi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119977 (WordPress Core is vulnerable to Remote Code Execution in versions 4.7 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119730 (Maxthon Browser for Android before 7.5.8.103 contains an address bar s ...)
TODO: check
CVE-2026-119343 (Stirling-PDF is a locally hosted web application that facilitates vari ...)
@@ -207,33 +207,33 @@ CVE-2026-119329 (Immich is a high-performance self-hosted photo and video manage
CVE-2026-119328 (Immich is a high-performance self-hosted photo and video management so ...)
TODO: check
CVE-2026-119166 (The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119163 (The FunnelKit Automations \u2013 Email Marketing Automation and CRM fo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119162 (The User Submitted Posts \u2013 Enable Users to Submit Posts from the ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119089 (The ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Link Trac ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-119065 (The Shipping Zones by Drawing for WooCommerce plugin for WordPress is ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118938 (In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operan ...)
TODO: check
CVE-2026-118638 (The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118629 (The All-in-One Video Gallery WordPress plugin before 5.0.0 does not c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118438 (The Firelight Lightbox WordPress plugin before 2.3.24 does not properl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118437 (The BuddyForms WordPress plugin before 2.10.1 does not properly verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118185 (The Security Optimizer WordPress plugin before 1.6.9 does not limit t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118184 (The Premium Packages WordPress plugin before 7.2.2 does not prevent u ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118070 (The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-118043 (The Bulk Media Register WordPress plugin before 2.01 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-117666 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
TODO: check
CVE-2026-117656 (Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilit ...)
@@ -243,17 +243,17 @@ CVE-2026-117645 (Improper Neutralization of Input During Web Page Generation ('C
CVE-2026-116755 (Improper Neutralization of Special Elements used in a Command ('Comman ...)
TODO: check
CVE-2026-116563 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN Gallery ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116557 (The WP Booking System - Booking Calendar plugin for WordPress is vulne ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116548 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116546 (The WP Job Portal \u2013 AI-Powered Recruitment System for Company or ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116522 (The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerab ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116520 (The PPWP \u2013 Password Protect Pages plugin for WordPress is vulnera ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-116252 (pgAdmin 4's materialized view refresh passed the target database's nam ...)
TODO: check
CVE-2026-116251 (pgAdmin 4 did not invalidate a user's existing sessions when their pas ...)
@@ -285,51 +285,51 @@ CVE-2026-116239 (In server mode pgAdmin 4 keeps an account per authentication so
CVE-2026-116238 (In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATT ...)
TODO: check
CVE-2026-115840 (The VikRentCar Car Rental Management System plugin for WordPress is vu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-115830 (In Secret Server versions earlier than 12.3.1, a user under certain co ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-115829 (In Secret Server versions earlier than 12.3.1, a user could bypass the ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-115828 (In Secret Server versions earlier than 12.3.1, Secret Server did not a ...)
- TODO: check
+ NOT-FOR-US: Delinea
CVE-2026-111578 (The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111477
REJECTED
CVE-2026-111254 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-111109 (The Webmention plugin for WordPress is vulnerable to Stored Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110808 (The Essential Addons for Elementor WordPress plugin before 6.8.8 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110251 (The Photo Reviews for WooCommerce plugin for WordPress is vulnerable t ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-110176 (The File Force Download module for Drupal 7 implements hook_file_downl ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-110042 (The Payment Forms for Paystack WordPress plugin before 4.0.6 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109997 (The Ninja Forms \u2013 Contact Form Builder with Calculators, Quizzes, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109386 (The Hustle \u2013 Email Marketing, Lead Generation, Optins, Popups plu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109234 (The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109220 (The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109217 (The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-109213
REJECTED
CVE-2026-107765 (The Discussion Board \u2013 WordPress Forum Plugin plugin for WordPres ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107750 (The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-107653 (The SureCart \u2013 Ecommerce Made Easy For Selling Physical Products, ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-101326 (The The Ninja Forms \u2013 Contact Form Builder with Calculators, Quiz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-100155 (The The Ninja Forms \u2013 Contact Form Builder with Calculators, Quiz ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-XXXX [GHSA-6w3p-4pq7-j3mp: UEFI Secure Boot bypass via stack overflow vulnerability in signed fwupd EFI application]
- fwupd-efi 1:1.9-1
NOTE: https://github.com/fwupd/fwupd-efi/security/advisories/GHSA-6w3p-4pq7-j3mp
@@ -381,7 +381,7 @@ CVE-2026-76012 (The Photo Gallery, Sliders, Proofing and Themes \u2013 NextGEN G
CVE-2026-75882 (An improper access control vulnerability in ESET Endpoint Encryption a ...)
TODO: check
CVE-2026-73322 (Incorrect Authorization vulnerability in the single-stage query engine ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-73186 (Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-69446 (Incorrect authorization in Microsoft Edge (Chromium-based) allows an a ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea3bfe08bbc9e854f913587f3fc84728705025fb
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ea3bfe08bbc9e854f913587f3fc84728705025fb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/7ef24f75/attachment.htm>
More information about the debian-security-tracker-commits
mailing list