[Git][security-tracker-team/security-tracker][master] Process some NFUs

Sat Oct 31 16:53:10 GMT 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c7e91d40 by Salvatore Bonaccorso at 2026-10-31T17:51:42+01:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -95,7 +95,7 @@ CVE-2026-62990 (Shopper is a Headless e-commerce Admin Panel. In versions from 2
 CVE-2026-62989 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Var ...)
 	NOT-FOR-US: Shopper
 CVE-2026-62979 (jack lets users share media libraries through their Radarr/Sonarr stac ...)
-	TODO: check
+	NOT-FOR-US: roziscoding/jack
 CVE-2026-62968 (Dream Displays provides in-game screens for streaming videos in Minecr ...)
 	NOT-FOR-US: Dream Displays
 CVE-2026-62967 (ZTNET is a ZeroTier web UI for private controllers with multiuser and  ...)
@@ -107,52 +107,52 @@ CVE-2026-62965 (SABnzbd is an open source automated Usenet download tool. Prior
 	NOTE: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hxwh-mmrg-p8f5
 	NOTE: Fixed by: https://github.com/sabnzbd/sabnzbd/commit/e3e7fcf361eaebec2d76397b3d27f854f8266410 (5.1.0Beta3)
 CVE-2026-62958 (libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted EL ...)
-	TODO: check
+	NOT-FOR-US: libriscv
 CVE-2026-62864 (Ring is a Clojure web applications library inspired by Python's WSGI a ...)
-	TODO: check
+	NOT-FOR-US: ring-clojure
 CVE-2026-62863 (MoLing is a computer-use and browser-use based MCP server. Prior to 0. ...)
-	TODO: check
+	NOT-FOR-US: MoLing
 CVE-2026-62860 (Picsou is a self-hosted personal finance dashboard. In the affected lo ...)
-	TODO: check
+	NOT-FOR-US: Picsou
 CVE-2026-62853 (ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovy ...)
-	TODO: check
+	NOT-FOR-US: ThingLinks
 CVE-2026-62849 (ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthent ...)
-	TODO: check
+	NOT-FOR-US: ThingLinks
 CVE-2026-62848 (Metalama is a Roslyn-based open-source patterns and architecture toolk ...)
-	TODO: check
+	NOT-FOR-US: Metalama
 CVE-2026-62847 (Metalama is a Roslyn-based open-source patterns and architecture toolk ...)
-	TODO: check
+	NOT-FOR-US: Metalama
 CVE-2026-62347 (Element Call is a native Matrix video conferencing application. From 0 ...)
-	TODO: check
+	NOT-FOR-US: Element Call
 CVE-2026-62337 (SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo ...)
-	TODO: check
+	NOT-FOR-US: SNARK Verifier
 CVE-2026-62335 (OpenVM is a performant and modular zkVM framework built for customizat ...)
-	TODO: check
+	NOT-FOR-US: OpenVM
 CVE-2026-62334 (OpenVM is a performant and modular zkVM framework built for customizat ...)
-	TODO: check
+	NOT-FOR-US: OpenVM
 CVE-2026-62333 (OpenVM is a performant and modular zkVM framework built for customizat ...)
-	TODO: check
+	NOT-FOR-US: OpenVM
 CVE-2026-62331 (praktor is a multi-agent Claude Code orchestrator with Telegram input  ...)
-	TODO: check
+	NOT-FOR-US: praktor
 CVE-2026-62302 (MyTube is a self-hosted downloader and player for several video websit ...)
-	TODO: check
+	NOT-FOR-US: MyTube
 CVE-2026-62301 (MyTube is a self-hosted downloader and player for several video websit ...)
-	TODO: check
+	NOT-FOR-US: MyTube
 CVE-2026-62300 (Filecoin Pin is an IPFS Pinning Service API implementation that pins t ...)
-	TODO: check
+	NOT-FOR-US: Filecoin Pin
 CVE-2026-62297 (ag-psd is a JavaScript library for reading and writing Photoshop Docum ...)
-	TODO: check
+	NOT-FOR-US: ag-psd
 CVE-2026-62284 (OSAC operator is a Kubernetes operator. In the affected revision ident ...)
-	TODO: check
+	NOT-FOR-US: OSAC operator
 CVE-2026-62277 (LubeLogger is a self-hosted, open-source, web-based vehicle maintenanc ...)
-	TODO: check
+	NOT-FOR-US: LubeLogger
 CVE-2026-62254 (LibreDWG is a free C library to read and write DWG files. Prior to 0.1 ...)
 	- libredwg <itp> (bug #595191)
 	TODO: check
 CVE-2026-62250 (LibreDWG is a free C library to read and write DWG files. Prior to 0.1 ...)
 	- libredwg <itp> (bug #595191)
 CVE-2026-61850 (Kargo manages and automates the promotion of software artifacts. From  ...)
-	TODO: check
+	NOT-FOR-US: Kargo
 CVE-2026-61725 (sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior  ...)
 	TODO: check
 CVE-2026-61694 (go-xrpl is a Go implementation of the XRP Ledger protocol. In versions ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c7e91d4087915ea674fc21296f7367f12986665f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c7e91d4087915ea674fc21296f7367f12986665f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/134667b8/attachment.htm>
