[Git][security-tracker-team/security-tracker][master] NFUs

Sat Oct 31 22:08:27 GMT 2026


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7d14719b by Moritz Muehlenhoff at 2026-10-31T23:08:06+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -17,7 +17,7 @@ CVE-2026-15272 (The Web 2.0 Directory plugin for WordPress is vulnerable to time
 CVE-2026-120210 (FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in th ...)
 	TODO: check
 CVE-2026-120209 (AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secre ...)
-	TODO: check
+	NOT-FOR-US: AJ-Report
 CVE-2026-120207 (Thelia Page Module before 2.0.4 contains a cross-site request forgery  ...)
 	NOT-FOR-US: Thelia
 CVE-2026-120206 (Thelia before 3.2.0 contains a cross-site request forgery vulnerabilit ...)
@@ -25,17 +25,17 @@ CVE-2026-120206 (Thelia before 3.2.0 contains a cross-site request forgery vulne
 CVE-2026-120205 (Thelia before 3.1.0 contains a stored cross-site scripting vulnerabili ...)
 	NOT-FOR-US: Thelia
 CVE-2026-120204 (DeepInfer through 0.1.0 contains a path traversal vulnerability in the ...)
-	TODO: check
+	NOT-FOR-US: DeepInfer
 CVE-2026-120203 (ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: ShowDoc
 CVE-2026-120202 (Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypas ...)
-	TODO: check
+	NOT-FOR-US: Highflame
 CVE-2026-120201 (Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerab ...)
-	TODO: check
+	NOT-FOR-US: Jpom
 CVE-2026-120200 (Nexterm through 1.2.2-BETA contains a missing authorization vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Nexterm
 CVE-2026-120199 (LearnHouse before 1.1.1 contains a missing authorization vulnerability ...)
-	TODO: check
+	NOT-FOR-US: LearnHouse
 CVE-2026-120194 (A flaw was found in json-glib. The JSONPath slice evaluator used by js ...)
 	- json-glib <unfixed>
 	NOTE: https://gitlab.gnome.org/GNOME/json-glib/-/issues/96
@@ -56,9 +56,9 @@ CVE-2026-118147 (Improper certificate validation in Visual Studio allows an unau
 CVE-2026-118057 (The Shield Security \u2013 Smart Bot Blocking, Brute-Force Login Prote ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-117681 (A flaw was found in konflux-ci. This vulnerability allows privilege es ...)
-	TODO: check
+	NOT-FOR-US: konflux-ci
 CVE-2026-116964 (A flaw was found in konflux-ci. An attacker with repository write acce ...)
-	TODO: check
+	NOT-FOR-US: konflux-ci
 CVE-2026-116752 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-116535 (The SEOPress \u2013 AI SEO Plugin & On-site SEO plugin for WordPress i ...)
@@ -66,9 +66,9 @@ CVE-2026-116535 (The SEOPress \u2013 AI SEO Plugin & On-site SEO plugin for Word
 CVE-2026-116512 (The Project Manager \u2013 AI Powered Project Management, Task Managem ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-116086 (A flaw was found in konflux-ci. An attacker with permission to trigger ...)
-	TODO: check
+	NOT-FOR-US: konflux-ci
 CVE-2026-114217 (A flaw was found in konflux-ci. Continuous Integration (CI) automation ...)
-	TODO: check
+	NOT-FOR-US: konflux-ci
 CVE-2026-111592 (The Co-Authors, Multiple Authors and Guest Authors in an Author Box wi ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-111070 (The Content Pilot \u2013 Autoblogging & Affiliate Marketing Suite plug ...)
@@ -291,21 +291,21 @@ CVE-2026-55613 (uhttpd is a small HTTP server. In unpatched repository snapshots
 CVE-2026-55612 (uhttpd is a small HTTP server. In unpatched repository snapshots, `cli ...)
 	NOT-FOR-US: uhttpd in OpenWrt
 CVE-2026-55598 (PinePods is a complete, self-hosted podcast management system written  ...)
-	TODO: check
+	NOT-FOR-US: PinePods
 CVE-2026-55493 (HotCRP is conference review software. Starting with 2.101, the `cmt:`  ...)
-	TODO: check
+	NOT-FOR-US: HotCRP
 CVE-2026-55147 (LORIS (Longitudinal Online Research and Imaging System) is a self-host ...)
 	NOT-FOR-US: LORIS (Longitudinal Online Research and Imaging System)
 CVE-2026-55146 (LORIS (Longitudinal Online Research and Imaging System) is a self-host ...)
 	NOT-FOR-US: LORIS (Longitudinal Online Research and Imaging System)
 CVE-2026-55098 (Arc is an open, SQL-native time-series database for telemetry. Prior t ...)
-	TODO: check
+	NOT-FOR-US: Arm
 CVE-2026-54610 (LibreDWG is a free C library to read and write DWG files. Prior to 0.1 ...)
 	- libredwg <itp> (bug #595191)
 CVE-2026-40573 (NovumOS is a custom 32-bit operating system written in Zig and x86 Ass ...)
-	TODO: check
+	NOT-FOR-US: NovumOS
 CVE-2026-16760 (In Trail of Bits fickling through 0.1.12, the _process_import() method ...)
-	TODO: check
+	NOT-FOR-US: fickling
 CVE-2026-120040 (The Mail logging & Catcher plugin for WordPress is vulnerable to Sensi ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-120019 (The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross- ...)
@@ -317,7 +317,7 @@ CVE-2026-119980 (The UsersWP \u2013 Front-end login form, User Registration, Use
 CVE-2026-119977 (WordPress Core is vulnerable to Remote Code Execution in versions 4.7  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-119730 (Maxthon Browser for Android before 7.5.8.103 contains an address bar s ...)
-	TODO: check
+	NOT-FOR-US: Maxthon Browser
 CVE-2026-119343 (Stirling-PDF is a locally hosted web application that facilitates vari ...)
 	NOT-FOR-US: Stirling-PDF
 CVE-2026-119342 (Stirling-PDF is a locally hosted web application that facilitates vari ...)
@@ -373,7 +373,7 @@ CVE-2026-119089 (The ThirstyAffiliates \u2013 Affiliate Links, Link Branding, Li
 CVE-2026-119065 (The Shipping Zones by Drawing for WooCommerce plugin for WordPress is  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-118938 (In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operan ...)
-	TODO: check
+	NOT-FOR-US: fickling
 CVE-2026-118638 (The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-118629 (The All-in-One Video Gallery  WordPress plugin before 5.0.0 does not c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7d14719beada1a1b06d7a840ee343c5d8ff655bb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7d14719beada1a1b06d7a840ee343c5d8ff655bb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/1e6ebb98/attachment.htm>
