[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4b07bb57 by Salvatore Bonaccorso at 2026-09-15T21:44:08+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -42,45 +42,45 @@ CVE-2026-91990 (Tornado before 6.5.8 contains a memory amplification vulnerabili
 	- python-tornado <unfixed>
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
 CVE-2026-91989 (atomic-agents-stack before 1.1.0 contains a path traversal vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: atomic-agents-stack
 CVE-2026-91988 (atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the ...)
-	TODO: check
+	NOT-FOR-US: atomic-agents-stack
 CVE-2026-91987 (atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in t ...)
-	TODO: check
+	NOT-FOR-US: atomic-agents-stack
 CVE-2026-91986 (gitoxide gix-transport before 0.59.2 fails to filter control character ...)
 	TODO: check
 CVE-2026-91985 (Vikunja before 2.6.0 fails to properly restrict access to the link-sha ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91984 (Vikunja before 2.6.0 fails to validate that user-supplied project_view ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91983 (Vikunja before 2.6.0 contains an API token scope bypass vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91982 (Vikunja before 2.6.0 continues to expose the raw TOTP shared secret af ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91981 (Vikunja versions before 2.6.0 fail to properly validate link-share tok ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91980 (vikunja before 2.6.0 fails to validate team access when attaching team ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91979 (Vikunja before 2.6.0 fails to limit archive expansion during data impo ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91973 (Vikunja before 2.6.0 contains an authentication bypass vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91972 (Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 p ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91971 (Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and  ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91970 (Vikunja versions before 2.6.0 contain a resource exhaustion vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91969 (vikunja versions before 2.6.0 contain a resource exhaustion vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91968 (vikunja versions before 2.6.0 contain a resource exhaustion vulnerabil ...)
-	TODO: check
+	NOT-FOR-US: Vikunja
 CVE-2026-91967 (AVideo through 29.0 contains a blind server-side request forgery vulne ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-91966 (AVideo through 29.0 contains an unauthenticated server-side request fo ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-91965 (WWBN AVideo through 29.0 fails to enforce user-group restrictions in t ...)
-	TODO: check
+	NOT-FOR-US: WWBN AVideo
 CVE-2026-91964 (FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in ...)
 	TODO: check
 CVE-2026-91963 (FreeRDP versions before 3.31.0 contain an uninitialized heap memory di ...)
@@ -122,15 +122,15 @@ CVE-2026-91946 (FreeRDP versions before 3.31.0 contain an information disclosure
 CVE-2026-91945 (FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerabi ...)
 	TODO: check
 CVE-2026-91944 (crawl4ai versions before 0.9.3 contain a DOM-based cross-site scriptin ...)
-	TODO: check
+	NOT-FOR-US: crawl4ai
 CVE-2026-91943 (Crawl4AI before 0.9.3 contains a server-side request forgery vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-91942 (crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulner ...)
-	TODO: check
+	NOT-FOR-US: crawl4ai
 CVE-2026-91941 (Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vu ...)
-	TODO: check
+	NOT-FOR-US: Crawl4AI
 CVE-2026-91940 (crawl4ai before 0.9.3 contains an arbitrary file write vulnerability i ...)
-	TODO: check
+	NOT-FOR-US: crawl4ai
 CVE-2026-91938 (Flowise versions before 3.1.4 contain a server-side request forgery vu ...)
 	NOT-FOR-US: Flowise
 CVE-2026-91937 (Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId pa ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4b07bb57811d63f17acac2ec41e2c79cab7bf3c8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4b07bb57811d63f17acac2ec41e2c79cab7bf3c8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260915/07a8757a/attachment-0001.htm>