[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Sat Oct 31 22:13:22 GMT 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
31328366 by Moritz Muehlenhoff at 2026-10-31T23:13:03+01:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -664,7 +664,7 @@ CVE-2026-54850 (Subscriber Broken Access Control in Booking and Rental Manager <
 CVE-2026-52710 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Bas ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-50000 (SecureDrop is an open-source whistleblower submission system that medi ...)
-	TODO: check
+	NOT-FOR-US: SecureDrop
 CVE-2026-49116
 	REJECTED
 CVE-2026-49115
@@ -811,7 +811,7 @@ CVE-2026-119711 (PipesHub before 0.10.0 contains a rate limit bypass vulnerabili
 CVE-2026-119710 (PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerab ...)
 	NOT-FOR-US: PipesHub
 CVE-2026-119709 (Grimoire before 1.0.0 contains an unauthenticated server-side request  ...)
-	TODO: check
+	NOT-FOR-US: Grimoire
 CVE-2026-119708 (abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authoriza ...)
 	NOT-FOR-US: abp-next-admin
 CVE-2026-119707 (SonicJS through 3.0.0 contains a missing authorization vulnerability i ...)
@@ -849,19 +849,19 @@ CVE-2026-119661 (ShowDoc through 3.9.5 contains an authorization bypass vulnerab
 CVE-2026-119660 (MuseBot before 2.0.0 contains an authentication bypass vulnerability t ...)
 	NOT-FOR-US: MuseBot
 CVE-2026-119659 (Blossom through 1.17.1 contains an authorization bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Blossom
 CVE-2026-119658 (PowerDNS-Admin through 2026.08.1 contains an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: PowerDNS-Admin
 CVE-2026-119657 (FilePress through 3.0.1 contains a missing authorization vulnerability ...)
-	TODO: check
+	NOT-FOR-US: FilePress
 CVE-2026-119656 (CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql in ...)
-	TODO: check
+	NOT-FOR-US: CoreShop
 CVE-2026-119655 (CoreShop through 1.5.5 contains an unauthenticated sql injection vulne ...)
-	TODO: check
+	NOT-FOR-US: CoreShop
 CVE-2026-119654 (DataCap through 2025.1.1 contains a missing authorization vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: DataCap
 CVE-2026-119653 (Nging through 5.3.5 contains an information disclosure vulnerability t ...)
-	TODO: check
+	NOT-FOR-US: Nging
 CVE-2026-119652 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
 	NOT-FOR-US: HuLa-Server
 CVE-2026-119651 (HuLa-Server through 3.0.7 contains an insecure direct object reference ...)
@@ -877,13 +877,13 @@ CVE-2026-119647 (RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass v
 CVE-2026-119646 (Open Web Analytics before 1.14.1 contains an authorization vulnerabili ...)
 	NOT-FOR-US: Open Web Analytics
 CVE-2026-119645 (ZenTao PMS through 22.6 contains a missing authorization vulnerability ...)
-	TODO: check
+	NOT-FOR-US: ZenTao PMS
 CVE-2026-119644 (Blossom through 1.17.1 contains an authorization bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Blossom
 CVE-2026-119620 (A vulnerability was determined in 37954679 cak-filemanagement-system u ...)
-	TODO: check
+	NOT-FOR-US: cak-filemanagement-system
 CVE-2026-119619 (A vulnerability was found in 37954679 cak-filemanagement-system up to  ...)
-	TODO: check
+	NOT-FOR-US: cak-filemanagement-system
 CVE-2026-119602 (libmspack through 0.11alpha contains an uninitialized memory disclosur ...)
 	TODO: check
 CVE-2026-119601 (AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerabilit ...)
@@ -891,25 +891,25 @@ CVE-2026-119601 (AFFLIB through 3.7.22 contains a heap out-of-bounds write vulne
 CVE-2026-119600 (tcpflow through 1.6.1 contains an out-of-bounds read vulnerability tha ...)
 	TODO: check
 CVE-2026-119599 (AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: AxonHub
 CVE-2026-119598 (Miaomiaowu before 0.9.3 contains an insecure direct object reference v ...)
-	TODO: check
+	NOT-FOR-US: Miaomiaowu
 CVE-2026-119597 (OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulne ...)
-	TODO: check
+	NOT-FOR-US: OpenDeepWiki
 CVE-2026-119596 (UNIT3D through 9.2.0 contains a missing authorization vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: UNIT3D
 CVE-2026-119591 (SQLite before 3.54.0 contains a stack exhaustion vulnerability in coun ...)
 	TODO: check
 CVE-2026-119586 (SQLite command-line shell through 3.54.1 contains a command injection  ...)
 	TODO: check
 CVE-2026-119578 (MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnera ...)
-	TODO: check
+	NOT-FOR-US: MONAI
 CVE-2026-119577 (ArcadeDB before 26.10.2 contains an improper authorization vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: ArcadeDB
 CVE-2026-119576 (ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass  ...)
-	TODO: check
+	NOT-FOR-US: ArcadeDB
 CVE-2026-119575 (ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request for ...)
-	TODO: check
+	NOT-FOR-US: ArcadeDB
 CVE-2026-119574 (Traefik from 3.2.0 before 3.7.15 contains a data race in the experimen ...)
 	- traefik <itp> (bug #983289)
 CVE-2026-119573 (Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the K ...)
@@ -929,9 +929,9 @@ CVE-2026-119567 (vsftpd through 3.0.5 contains an access control bypass vulnerab
 CVE-2026-119566 (Prometheus through 3.15.1 contains a credential leak vulnerability tha ...)
 	TODO: check
 CVE-2026-119565 (Plausible Analytics through 3.2.1 contains a mass assignment vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Plausible Analytics
 CVE-2026-119564 (Plausible Analytics Community Edition through 3.2.1 contains an inform ...)
-	TODO: check
+	NOT-FOR-US: Plausible Analytics
 CVE-2026-119563 (phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulner ...)
 	TODO: check
 CVE-2026-119562 (phpMyAdmin through 5.2.3 contains an sql injection vulnerability that  ...)
@@ -939,9 +939,9 @@ CVE-2026-119562 (phpMyAdmin through 5.2.3 contains an sql injection vulnerabilit
 CVE-2026-119561 (phpMyAdmin through 5.2.3 contains an authentication bypass vulnerabili ...)
 	TODO: check
 CVE-2026-119560 (OPNsense core through 26.7.8 contains a configuration injection vulner ...)
-	TODO: check
+	NOT-FOR-US: OPNsense
 CVE-2026-119559 (OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerab ...)
-	TODO: check
+	NOT-FOR-US: OpenLiteSpeed
 CVE-2026-119558 (OpenCart through 4.1.0.4 contains a business logic vulnerability that  ...)
 	NOT-FOR-US: OpenCart
 CVE-2026-119557 (n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability ...)
@@ -963,7 +963,7 @@ CVE-2026-119550 (Jellyfin through 12.4 contains an information disclosure vulner
 CVE-2026-119549 (Jellyfin through 12.4 contains a server-side request forgery vulnerabi ...)
 	- jellyfin-server <itp> (bug #994189)
 CVE-2026-119548 (Lago through 1.55.0 contains an authorization bypass vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: Lago
 CVE-2026-119547 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17. ...)
 	- forgejo <itp> (bug #1058932)
 CVE-2026-119546 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17. ...)
@@ -1004,7 +1004,7 @@ CVE-2026-119422 (Juspay Hyperswitch before 1.128.0 contains an authentication by
 CVE-2026-119421 (Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) co ...)
 	NOT-FOR-US: Juspay Hyperswitch
 CVE-2026-119420 (Lago through 1.55.0 contains an authentication bypass vulnerability th ...)
-	TODO: check
+	NOT-FOR-US: Lago
 CVE-2026-119419 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
 	- cakephp <removed>
 CVE-2026-119418 (CakePHP through 5.4.3 contains an sql injection vulnerability that all ...)
@@ -1022,7 +1022,7 @@ CVE-2026-119409 (OPNsense before 26.7.8 contains a command injection vulnerabili
 CVE-2026-119408 (n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains ...)
 	NOT-FOR-US: n8n
 CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest credential ...)
-	TODO: check
+	NOT-FOR-US: Element
 CVE-2026-119379 (SQLite before 3.54.0 built with the session extension contains a heap  ...)
 	TODO: check
 CVE-2026-119378 (SQLite before 3.54.0 contains a use-after-free vulnerability in the R- ...)
@@ -1056,7 +1056,7 @@ CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains
 	NOTE: https://github.com/proftpd/proftpd/issues/2374
 	NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af (v1.3.10rc5)
 CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to 11.11, the use ...)
-	TODO: check
+	NOT-FOR-US: Wekan
 CVE-2026-119299 (gopacket provides packet processing capabilities for Go. Prior to 1.7. ...)
 	TODO: check
 CVE-2026-119298 (croc is a tool that allows any two computers to simply and securely tr ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/313283661ff4444a73463366089c3729147f406d

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/313283661ff4444a73463366089c3729147f406d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/8e1a96be/attachment.htm>

More information about the debian-security-tracker-commits mailing list