[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 2 20:15:54 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
34ce78f4 by security tracker role at 2026-09-02T19:15:47+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,5 +1,5 @@
CVE-2026-8151 (The Simple Membership MailChimp Integration WordPress plugin before 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84841 (A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5 ...)
TODO: check
CVE-2026-84840 (A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. T ...)
@@ -11,7 +11,7 @@ CVE-2026-84838 (A flaw was found in rpmuncompress. This command injection vulner
CVE-2026-84837 (A flaw was found in rpm. An attacker can exploit a command injection v ...)
TODO: check
CVE-2026-84835 (Missing Authorization vulnerability in DimaFreund Rentsyst allows Expl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84833 (A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa ...)
TODO: check
CVE-2026-84811 (agentverus-scanner fails to analyze compiled Python bytecode files in ...)
@@ -31,113 +31,113 @@ CVE-2026-84805 (Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-o
CVE-2026-84804 (Kimai before 2.65.0 fails to properly validate permissions when removi ...)
TODO: check
CVE-2026-84803 (SiYuan before v3.8.2 contains a stored cross-site scripting vulnerabil ...)
- TODO: check
+ NOT-FOR-US: SiYuan
CVE-2026-84802 (Craft CMS versions from 5.7.0 before 5.10.12 contain an information di ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84801 (Craft CMS versions before 5.10.11 fail to validate admin status in the ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84800 (Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing author ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84799 (Craft CMS before 5.11.0 fails to enforce user-group scope filters on n ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84798 (Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an indep ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84797 (Craft CMS versions before 5.10.11 contain an authorization bypass vuln ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84796 (Craft CMS versions before 5.10.11 contain a site scope bypass vulnerab ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84795 (Craft CMS before 5.10.11 fails to validate the admin flag during user ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84794 (Craft CMS versions before 5.10.11 lack authorization checks in the ass ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84793 (Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cros ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84792 (Craft CMS versions before 5.10.11 contain a broken access control vuln ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-84781 (Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84780 (Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84775 (Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84772 (Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84771 (Unauthenticated Insecure Direct Object References (IDOR) in PublishPre ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84770 (Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84764 (Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule A ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84760 (Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84759 (Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84677 (Jenkins update-center2 3.18.3 and earlier does not escape plugin-provi ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84676 (Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores t ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84675 (OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84674 (Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84673 (Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier al ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84672 (Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9c ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84671 (Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows w ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84670 (Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not r ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84669 (A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and ear ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84668 (Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriti ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84667 (Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plu ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84666 (Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earl ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84665 (Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84664 (Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84663 (A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84662 (Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecti ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84661 (A missing permission check in Jenkins Pipeline: Build Step Plugin 599. ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84660 (A missing permission check in Jenkins Pipeline: Build Step Plugin 599. ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84659 (Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does no ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84658 (Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses th ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84657 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI c ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84656 (A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 a ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84655 (Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84654 (In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e580 ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84653 (Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.56 ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84652 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does no ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84651 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API an ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84650 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient field ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84649 (In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inc ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84648 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84647 (In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e580 ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84646 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects ca ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84645 (In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of type ...)
- TODO: check
+ NOT-FOR-US: Jenkins (core or plugin)
CVE-2026-84382 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, t ...)
TODO: check
CVE-2026-84381 (HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, h ...)
@@ -153,21 +153,21 @@ CVE-2026-84377 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenA
CVE-2026-84376 (Astro is a web framework for content-driven websites. Prior to 7.2.4, ...)
TODO: check
CVE-2026-84217 (Missing Authorization vulnerability in Mamunur Rashid Classified Listi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-84175 (In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches W ...)
TODO: check
CVE-2026-83562 (Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-83547 (The Xpro Addons WordPress plugin before 1.7.4 does not properly escape ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-83533 (The WP Express Checkout WordPress plugin before 2.4.9 does not verify ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82958 (In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMes ...)
TODO: check
CVE-2026-82955 (In the current development version of Eclipse aeriOS, which has not ye ...)
TODO: check
CVE-2026-82884 (The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82522 (libjxl before 0.12 contains an integer underflow vulnerability in the ...)
TODO: check
CVE-2026-82404 (TOON is a compact, human-readable serialization of JSON data for LLM p ...)
@@ -175,61 +175,61 @@ CVE-2026-82404 (TOON is a compact, human-readable serialization of JSON data for
CVE-2026-82293 (Incorrect Authorization (CWE-863) in the Kibana machine learning featu ...)
TODO: check
CVE-2026-82223 (Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81775 (Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81774 (Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachm ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81772 (Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81771 (Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81770 (Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81769 (Incorrect Privilege Assignment vulnerability in LiquidThemes Booking H ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81571 (The Brave WordPress plugin before 0.8.8 does not prevent a URL paramet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81294 (Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81289 (Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Mus ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81288 (Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81286 (Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81283 (Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-81269 (Missing Authorization vulnerability in Drupal Data field allows Forcef ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81205 (Improper Neutralization of Special Elements used in an LDAP Query ('LD ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81201 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81168 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81167 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81166 (Missing Authorization vulnerability in Drupal Digital Signage Framewor ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81165 (Incorrect Authorization vulnerability in Drupal Blazy allows Forceful ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81164 (Missing Authorization vulnerability in Drupal Entity PDF allows Forcef ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81162 (Insertion of Sensitive Information Into Sent Data vulnerability in Dru ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81161 (Privilege Defined With Unsafe Actions vulnerability in Drupal Content ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81160 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81159 (Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSo ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-81158 (Incorrect Authorization vulnerability in Drupal Entity API allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-79991 (Craft CMS GraphQL entry mutation resolvers (saveEntry,deleteEntry) rea ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-79990 (Craft CMS GraphQL entry mutation resolvers (saveEntry,deleteEntry) rea ...)
- TODO: check
+ NOT-FOR-US: Craft CMS or plugin for Craft CMS
CVE-2026-79989 (The vulnerability allows any authenticated user to change their own pa ...)
TODO: check
CVE-2026-79756 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
@@ -277,57 +277,57 @@ CVE-2026-78408 (The nsenter --join-cgroup option opens the target cgroup.procs f
CVE-2026-78222 (A vulnerability exists in NGINX JavaScript where a malformed HTTP resp ...)
TODO: check
CVE-2026-78153 (The Restrict User Access WordPress plugin before 2.8.1 does not normal ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77794 (The RegistrationMagic WordPress plugin before 6.0.9.9 does not validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77793 (The RegistrationMagic WordPress plugin before 6.0.9.9 does not validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-77180 (When NGINX Ingress Controller is configured with Ingress annotations, ...)
- TODO: check
+ NOT-FOR-US: F5
CVE-2026-77125 (A vulnerability was identified in Sonatype Nexus Repository 3 in which ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-77124 (In affected versions of Nexus Repository 3, the script execution endpo ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-77123 (Nexus Repository 3 contains a sensitive information disclosure vulnera ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-77122 (An authorization flaw in the REST API repository details endpoint (GET ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-77121 (A user account with permission to deploy artifacts to a hosted Maven r ...)
- TODO: check
+ NOT-FOR-US: Sonatype
CVE-2026-77009 (The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict ac ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-76782 (Vulnerability in Drupal Screenshot. This issue affects Screenshot vers ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-76759 (Vulnerability in Drupal Screenshot. This issue affects Screenshot vers ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-76758 (Vulnerability in Drupal Link content parser. This issue affects Link c ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-76757 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-76756 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-76755 (Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-75528 (The Broken Link Checker plugin for WordPress is vulnerable to Stored C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-73478 (Incorrect Authorization vulnerability in Drupal Diff allows Forceful B ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-73477 (Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forc ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-73476 (Improper Handling of Case Sensitivity vulnerability in Drupal External ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-73475 (Incorrect Authorization vulnerability in Drupal Commerce PayPal allows ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-73474 (Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Shar ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-66842 (BIG-IP has a vulnerability where an authenticated user of any role may ...)
TODO: check
CVE-2026-66652 (Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand To ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66362 (Description: When NGINX Plus is configured as the data plane for NGINX ...)
TODO: check
CVE-2026-63020 (A vulnerability exists in an undisclosed BIG-IP Configuration utility ...)
- TODO: check
+ NOT-FOR-US: F5
CVE-2026-55421 (Open edX Platform enables the authoring and delivery of online learnin ...)
TODO: check
CVE-2026-55221 (Boruta is a standalone authorization server that aims to implement OAu ...)
@@ -357,7 +357,7 @@ CVE-2026-52832 (Nuclio is a "Serverless" framework for Real-Time Events and Data
CVE-2026-52831 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
TODO: check
CVE-2026-4357 (The Embed HTML5 Game WordPress plugin through 1.3 does not properly re ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-49833 (DSpace open source software is a repository application which provides ...)
TODO: check
CVE-2026-49832 (DSpace open source software is a repository application which provides ...)
@@ -371,11 +371,11 @@ CVE-2026-49249 (Boruta is a standalone authorization server that aims to impleme
CVE-2026-45730 (Nuclio is a "Serverless" framework for Real-Time Events and Data Proce ...)
TODO: check
CVE-2026-32773 (There is a lack of XSS escaping in the Spark History Server prior to 3 ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-2811 (The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-2688 (The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded aut ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-23591
REJECTED
CVE-2026-23590
@@ -399,79 +399,79 @@ CVE-2026-20355 (Multiple vulnerabilities in the Secure/Multipurpose Internet Mai
CVE-2026-20354 (Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Exte ...)
TODO: check
CVE-2026-20281 (A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 a ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20280 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20279 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20278 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20277 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20276 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20275 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20274 (As part of Cisco's ongoing commitment to proactive security and produc ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-20212 (A vulnerability in the Silicon One integration for Cisco Nexus 9000 Se ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-19698 (The GutenKit WordPress plugin before 2.5.1 does not validate or escape ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19475 (An authenticated user with permission to query a SQL data source can b ...)
TODO: check
CVE-2026-19219 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.3.812, insuffic ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-19117 (Under specific conditions, an attacker can register an attacker-contro ...)
TODO: check
CVE-2026-18986 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-18672 (In Progress\xae Telerik\xae UI for AJAX prior to v2026.3.812, insuffic ...)
- TODO: check
+ NOT-FOR-US: Progress Software
CVE-2026-18329 (Description NGINX JavaScript (njs)and QuickJS (qjs) engineshave a vul ...)
TODO: check
CVE-2026-18058 (The mobile Smart Connect dashboard UI was subject to manipulation by 3 ...)
- TODO: check
+ NOT-FOR-US: Lenovo
CVE-2026-17563 (The User Frontend WordPress plugin before 4.3.11 does not enforce its ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-16647 (Authentication Bypass Using an Alternate Path or Channel vulnerability ...)
- TODO: check
+ NOT-FOR-US: Drupal core and addons
CVE-2026-14828 (Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM3 ...)
- TODO: check
+ NOT-FOR-US: Zoho
CVE-2026-14326 (The Timetics WordPress plugin through 1.0.61 does not enforce per-obje ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14255 (A maliciously crafted IFC file, when parsed through certain Autodesk p ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2026-14199 (Only self-managed Grafana instances with Auth Proxy authentication and ...)
TODO: check
CVE-2026-12704 (When SAML IdP-initiated login is enabled in Grafana Enterprise, the SA ...)
- TODO: check
+ NOT-FOR-US: Grafana Labs
CVE-2026-10821 (The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-9314 (The Developer Tools WordPress plugin through 1.1.3 contains an unauthe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-8945 (The Wp Edit Password Protected WordPress plugin before 1.3.5 allows pr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-7963 (The Easy Waveform Player plugin for WordPress is vulnerable to Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-15692 (The Icegram Express WordPress plugin before 5.8.6 does not properly es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-15490 (The Passster WordPress plugin before 4.2.26 has a flaw in its global p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-15489 (The Passster WordPress plugin before 4.2.24 does not handle input prop ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-15485 (The Auto x LINE WordPress plugin through 1.0.0 does not have authoriza ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-15481 (The Notification Bar for WordPress plugin through 1.1.8 exposes an una ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2025-13398
REJECTED
CVE-2024-7956 (A vulnerability exists in the affected products that allows a threat a ...)
- TODO: check
+ NOT-FOR-US: Rockwell Automation
CVE-2024-3773 (The LiveJournal Shortcode WordPress plugin through 1.1.1 does not vali ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-3360 (The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the c ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-9055 (The Booking for Appointments and Events Calendar \u2013 Amelia (Premiu ...)
NOT-FOR-US: WordPress plugin
CVE-2026-84715 (FeatherPanel versions before 1.3.7.10 fail to validate permissions in ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/34ce78f40338e2b030adbadafe786f39c3867424
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/34ce78f40338e2b030adbadafe786f39c3867424
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260902/5925de44/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list