[Git][security-tracker-team/security-tracker][master] Process some NFUs

Tue Sep 1 10:05:54 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0ea5c074 by Salvatore Bonaccorso at 2026-09-01T11:05:27+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -115,17 +115,17 @@ CVE-2026-82224 (Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10
 CVE-2026-82221 (Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0 ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-81892 (EasyAdmin is a fast and modern admin generator for Symfony application ...)
-	TODO: check
+	NOT-FOR-US: EasyAdmin
 CVE-2026-81891 (elFinder is an open-source file manager for web, written in JavaScript ...)
-	TODO: check
+	NOT-FOR-US: elFinder
 CVE-2026-81890 (elFinder is an open-source file manager for web, written in JavaScript ...)
-	TODO: check
+	NOT-FOR-US: elFinder
 CVE-2026-81889 (elFinder is an open-source file manager for web, written in JavaScript ...)
-	TODO: check
+	NOT-FOR-US: elFinder
 CVE-2026-81888 (@hono/oauth-providers is Authentication middleware for Hono. Prior to  ...)
-	TODO: check
+	NOT-FOR-US: Hono
 CVE-2026-81887 (Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 unti ...)
-	TODO: check
+	NOT-FOR-US: Livewire
 CVE-2026-81780 (Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-81779 (Improper Validation of Specified Quantity in Input vulnerability in Si ...)
@@ -167,27 +167,27 @@ CVE-2026-81278 (Missing Authorization vulnerability in WPExperts Post SMTP allow
 CVE-2026-81267 (A malicious webpage could stall a popup's cross-origin navigation afte ...)
 	TODO: check
 CVE-2026-79483 (FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a No ...)
-	TODO: check
+	NOT-FOR-US: FastGPT Community Edition
 CVE-2026-79408 (An OS command injection vulnerability in MetaGPT 0.8.1 allows an attac ...)
-	TODO: check
+	NOT-FOR-US: MetaGPT
 CVE-2026-79407 (A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 a ...)
-	TODO: check
+	NOT-FOR-US: MetaGPT
 CVE-2026-78319 (A service running on the affected products contains a potential Time-o ...)
-	TODO: check
+	NOT-FOR-US: Sauter
 CVE-2026-77950 (Generation of Error Message Containing Sensitive Information vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: ash-project
 CVE-2026-77856 (Allocation of Resources Without Limits or Throttling vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: ash-project
 CVE-2026-77823 (The LearnPress plugin for WordPress is vulnerable to SQL Injection via ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-77353 (Wallos is an open-source, self-hostable personal subscription tracker. ...)
-	TODO: check
+	NOT-FOR-US: Wallos
 CVE-2026-77352 (Wallos is an open-source, self-hostable personal subscription tracker. ...)
-	TODO: check
+	NOT-FOR-US: Wallos
 CVE-2026-77351 (Wallos is an open-source, self-hostable personal subscription tracker. ...)
-	TODO: check
+	NOT-FOR-US: Wallos
 CVE-2026-77348 (Wallos is an open-source, self-hostable personal subscription tracker. ...)
-	TODO: check
+	NOT-FOR-US: Wallos
 CVE-2026-77189 (The Charitable \u2013 Donation & Fundraising Platform (Donation Forms, ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-76006 (The Photo Gallery by Ays \u2013 Responsive Image Gallery plugin for Wo ...)
@@ -537,9 +537,9 @@ CVE-2026-78075 (Joomla Extension - joomshaper.com - Broken Object-Level Authoriz
 CVE-2026-78074 (Joomla Extension - miniorgange.com - Unauthenticated arbitrary extensi ...)
 	NOT-FOR-US: Joomla
 CVE-2026-77975 (The affected Ebyte   product exports administrative credentials and ot ...)
-	TODO: check
+	NOT-FOR-US: Ebyte
 CVE-2026-77966 (The affectedEbyte   productdoes not provide separation between limited ...)
-	TODO: check
+	NOT-FOR-US: Ebyte
 CVE-2026-76986 (Improper neutralization of input during web page generation in Apache  ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-76985 (Improper neutralization of input during web page generation in Apache  ...)
@@ -553,7 +553,7 @@ CVE-2026-76982 (Improper neutralization of input during web page generation in A
 CVE-2026-76763 (A flaw was found in SmallRye GraphQL. The number scalar coercion for B ...)
 	TODO: check
 CVE-2026-76133 (The affectedEbyte   product  uses a deprecated hashing algorithm in an ...)
-	TODO: check
+	NOT-FOR-US: Ebyte
 CVE-2026-75802 (AjaxEditableChoiceLabel in wicket-extensions, when constructed with a  ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-75133 (Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensiti ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0ea5c074b34b3e2fe2411e83db880796d9fb09b6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0ea5c074b34b3e2fe2411e83db880796d9fb09b6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260901/d3375c1c/attachment.htm>
