[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Sep 16 13:42:49 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
54788a69 by Moritz Muehlenhoff at 2026-09-16T14:42:36+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -365,7 +365,7 @@ CVE-2026-90439 (NGINX Plus and NGINX Open Source have a vulnerability in the ngx
NOTE: Fixed by: https://github.com/nginx/nginx/commit/7c7363266d54bc3836c1d13d1ed1e1d93ee9ed98 (release-1.31.6)
NOTE: Fixed by: https://github.com/nginx/nginx/commit/78399582a5d6d212e40ffc7f9ca61e6de7852d9c (release-1.30.5)
CVE-2026-89308 (An unauthenticated OS command injection vulnerability exists in thepin ...)
- TODO: check
+ NOT-FOR-US: TrxTimeATTENDANCE
CVE-2026-89307 (The "Firma Circolare" feature in the "Design Scuole Italia" WordPress ...)
NOT-FOR-US: WordPress theme
CVE-2026-89026 (The Issabel Framework, the web framework supporting Issabel PBX softwa ...)
@@ -459,7 +459,7 @@ CVE-2026-81236 (Dell Wyse Management Suite, versions prior to 2605.0.3.683, cont
CVE-2026-81235 (Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a ...)
NOT-FOR-US: Dell / EMC
CVE-2026-80217 (Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, whic ...)
- TODO: check
+ NOT-FOR-US: LITE-ON
CVE-2026-79705 (A flaw was found in the buildah/copier Go package. When used outside o ...)
- golang-github-containers-buildah <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2523419
@@ -469,27 +469,27 @@ CVE-2026-79699 (A flaw was found in the containers/storage library. A crafted ta
CVE-2026-79551 (Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to ...)
NOT-FOR-US: Tenda
CVE-2026-79425 (An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/f ...)
- TODO: check
+ NOT-FOR-US: CRMEB
CVE-2026-79411 (Incorrect privilege assignment in the admin user-management component ...)
- TODO: check
+ NOT-FOR-US: Webkul Bagisto
CVE-2026-79410 (Improper validation of the quantity parameter in the add-to-cart path ...)
- TODO: check
+ NOT-FOR-US: Webkul Bagisto
CVE-2026-79409 (An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain se ...)
- TODO: check
+ NOT-FOR-US: Webkul Bagisto
CVE-2026-79303 (kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injecti ...)
- TODO: check
+ NOT-FOR-US: kaiten
CVE-2026-78081 (Joomla Extension - j2commerce.com - Missing CSRF protection on cart, c ...)
NOT-FOR-US: Joomla
CVE-2026-77972 (Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allo ...)
- TODO: check
+ NOT-FOR-US: safeurl-elixir
CVE-2026-77866 (Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allow ...)
- TODO: check
+ NOT-FOR-US: safeurl-elixir
CVE-2026-77853 (Improper neutralization of special elements used in an OS command ('OS ...)
- TODO: check
+ NOT-FOR-US: LITE-ON
CVE-2026-77179 (On macOS, the virtio-fs host server used by Docker Sandboxes improperl ...)
- TODO: check
+ NOT-FOR-US: Docker Sandboxes for MacOS
CVE-2026-76159 (Incorrect Permission Assignment for Critical Resource in the configur ...)
- TODO: check
+ NOT-FOR-US: Duplicati
CVE-2026-75092 (A privilege escalation flaw was found in the scan_mysql actor of leapp ...)
NOT-FOR-US: leapp-repository
CVE-2026-73467 (On affected platforms running Arista EOS, under certain circumstances ...)
@@ -501,13 +501,13 @@ CVE-2026-73465 (On affected platforms running Arista EOS, under certain circumst
CVE-2026-73451 (On affected platforms running Arista EOS with dual switch cards and wi ...)
NOT-FOR-US: Arista Networks
CVE-2026-69211 (Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1. ...)
- TODO: check
+ NOT-FOR-US: Http4s
CVE-2026-69209 (Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1. ...)
- TODO: check
+ NOT-FOR-US: Http4s
CVE-2026-69208 (Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1. ...)
- TODO: check
+ NOT-FOR-US: Http4s
CVE-2026-69204 (Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1. ...)
- TODO: check
+ NOT-FOR-US: Http4s
CVE-2026-68534 (Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML wh ...)
NOT-FOR-US: Concrete CMS
CVE-2026-68533 (Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imp ...)
@@ -515,37 +515,37 @@ CVE-2026-68533 (Concrete CMS below 9.5.3 conversation attachment uploaded endpoi
CVE-2026-68532 (Concrete CMS 9.0.0 to dashboard group type controller did not validate ...)
NOT-FOR-US: Concrete CMS
CVE-2026-65831 (ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user ca ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-63696 (Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a ...)
NOT-FOR-US: Dell / EMC
CVE-2026-63695 (Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a ...)
NOT-FOR-US: Dell / EMC
CVE-2026-63443 (Coder allows organizations to provision remote development environment ...)
- TODO: check
+ NOT-FOR-US: Coder
CVE-2026-62379 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-62280 (Open Access Management (OpenAM) is an access management solution. From ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-62263 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-61668 (DIRAC is an interware, meaning a software framework for distributed co ...)
- TODO: check
+ NOT-FOR-US: DIRAC
CVE-2026-61667 (DIRAC is an interware, meaning a software framework for distributed co ...)
- TODO: check
+ NOT-FOR-US: DIRAC
CVE-2026-61549 (Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backen ...)
- TODO: check
+ NOT-FOR-US: Woodpecker
CVE-2026-59973 (FrontMCP is a TypeScript-first framework for the Model Context Protoco ...)
- TODO: check
+ NOT-FOR-US: FrontMCP
CVE-2026-59971 (MySQL MCP Server is a Model Context Protocol server that enables secur ...)
- TODO: check
+ NOT-FOR-US: MySQL MCP Server
CVE-2026-59965 (Payload Plugins is a collection of plugins designed to enhance Payload ...)
- TODO: check
+ NOT-FOR-US: Payload CMS plugins
CVE-2026-59341 (A security vulnerability exists in the Sealed Secrets controller's una ...)
- TODO: check
+ NOT-FOR-US: Sealed Secrets controlle
CVE-2026-59160 (Yeger is a monorepo for npm packages maintained under the yeger scope. ...)
NOT-FOR-US: Next.js
CVE-2026-59157 (webhookd is a minimalist webhook server that triggers shell scripts an ...)
- TODO: check
+ NOT-FOR-US: webhookd
CVE-2026-58773 (In link_load_gnss_image of link_device.c, there is a possible out-of-b ...)
NOT-FOR-US: Google devices
CVE-2026-58767 (In multiple functions of arm-smmu-v3.c, there is a possible escalation ...)
@@ -601,23 +601,23 @@ CVE-2026-58679 (In gf_ta_test_set_config of gf_ta_test.c, there is a possible he
CVE-2026-58678 (In Bootloader, there is a possible permission bypass due to a logic er ...)
NOT-FOR-US: Google devices
CVE-2026-58502 (githubtoplanguages generates a user's top GitHub languages as an SVG. ...)
- TODO: check
+ NOT-FOR-US: githubtoplanguages
CVE-2026-58485 (mcp-searxng is a Model Context Protocol server that gives AI assistant ...)
- TODO: check
+ NOT-FOR-US: mcp-searxng
CVE-2026-58483 (mcp-searxng is a Model Context Protocol server that gives AI assistant ...)
- TODO: check
+ NOT-FOR-US: mcp-searxng
CVE-2026-58201 (Lokka is a Model Context Protocol server for Microsoft 365, including ...)
- TODO: check
+ NOT-FOR-US: Lokka
CVE-2026-58200 (Payload Plugins is a collection of plugins designed to enhance Payload ...)
- TODO: check
+ NOT-FOR-US: Payload CMS plugins
CVE-2026-58196 (ToolHive is a utility designed to simplify the deployment and manageme ...)
- TODO: check
+ NOT-FOR-US: ToolHive
CVE-2026-57586 (CodeRAG is a lightweight semantic code search and distillation utility ...)
- TODO: check
+ NOT-FOR-US: CodeRAG
CVE-2026-57442 (MCPVault is a lightweight Model Context Protocol server for safe acces ...)
- TODO: check
+ NOT-FOR-US: MCPVault
CVE-2026-57441 (MCPVault is a lightweight Model Context Protocol server for safe acces ...)
- TODO: check
+ NOT-FOR-US: MCPVault
CVE-2026-57148 (PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_pla ...)
NOT-FOR-US: PraisonAI
CVE-2026-57147 (PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_pla ...)
@@ -725,23 +725,23 @@ CVE-2026-56881 (In enable_segment of remap.c, there is a possible permission byp
CVE-2026-56879 (In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corrupt ...)
NOT-FOR-US: Google devices
CVE-2026-56831 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpa ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-56830 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earli ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-56829 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-56827 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedB ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-56825 (Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages ...)
- TODO: check
+ NOT-FOR-US: Shopper
CVE-2026-55887 (MCP Gateway allows easy and secure running and deployment of MCP serve ...)
- TODO: check
+ NOT-FOR-US: MCP Gateway
CVE-2026-55864 (GeoNetwork is a catalog application to manage spatially referenced res ...)
- TODO: check
+ NOT-FOR-US: GeoNetwork
CVE-2026-55863 (motionEye (mEye) is an online interface for a piece of software called ...)
- TODO: check
+ NOT-FOR-US: motionEye
CVE-2026-55828 (qbee transport is a remote access transport protocol implementation. P ...)
- TODO: check
+ NOT-FOR-US: qbee
CVE-2026-55776 (OpenBao is an open source identity-based secrets management system. Pr ...)
- openbao <itp> (bug #1069794)
CVE-2026-55775 (OpenBao is an open source identity-based secrets management system. Pr ...)
@@ -756,25 +756,25 @@ CVE-2026-55701 (The OpenTelemetry Collector Contrib repository contains componen
NOTE: https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/47854
NOTE: https://github.com/open-telemetry/opentelemetry-collector-contrib/commit/54143ccd14f5ebd74ca741739d2099c7fbebbd98 (v0.151.0)
CVE-2026-55692 (The EmbedVideo Extension is a MediaWiki extension which adds a parser ...)
- TODO: check
+ NOT-FOR-US: EmbedVideo MediaWiki extension
CVE-2026-55691 (The EmbedVideo Extension is a MediaWiki extension which adds a parser ...)
- TODO: check
+ NOT-FOR-US: EmbedVideo MediaWiki extension
CVE-2026-55690 (The EmbedVideo Extension is a MediaWiki extension which adds a parser ...)
- TODO: check
+ NOT-FOR-US: EmbedVideo MediaWiki extension
CVE-2026-55650 (Outerbase Studio is a lightweight browser-based database GUI supportin ...)
- TODO: check
+ NOT-FOR-US: Outerbase Studio
CVE-2026-55636 (Capsule is a multi-tenancy and policy-based framework for Kubernetes. ...)
- TODO: check
+ NOT-FOR-US: Capsule
CVE-2026-55630 (Kiwi TCMS is an open source test management system. Prior to 16.1, Tes ...)
- TODO: check
+ NOT-FOR-US: Kiwi TCMS
CVE-2026-55617 (Hydro is a next-generation high-performance online judge platform. Fro ...)
- TODO: check
+ NOT-FOR-US: Hydro
CVE-2026-55591 (Signal K Server is a server application that runs on a central hub in ...)
- TODO: check
+ NOT-FOR-US: Signal K Server
CVE-2026-55375 (canto-saas-api is a PHP library for interacting with the Canto SaaS AP ...)
- TODO: check
+ NOT-FOR-US: canto-saas-api
CVE-2026-55374 (canto-saas-api is a PHP library for interacting with the Canto SaaS AP ...)
- TODO: check
+ NOT-FOR-US: canto-saas-api
CVE-2026-55366 (In IP Multimedia Subsystem, there is a possible authentication bypass ...)
NOT-FOR-US: Google devices
CVE-2026-55365 (In multiple functions of remap.c, there is a possible out-of-bounds wr ...)
@@ -812,11 +812,11 @@ CVE-2026-55158 (Conflibot warns in advance when merging a pull request will caus
CVE-2026-55149 (Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using th ...)
TODO: check
CVE-2026-54724 (Kiwi TCMS is an open source test management system. Prior to 16.1, the ...)
- TODO: check
+ NOT-FOR-US: Kiwi TCMS
CVE-2026-54689 (mcp-searxng is a Model Context Protocol server that gives AI assistant ...)
- TODO: check
+ NOT-FOR-US: mcp-searxng
CVE-2026-54688 (mcp-searxng is a Model Context Protocol server that gives AI assistant ...)
- TODO: check
+ NOT-FOR-US: mcp-searxng
CVE-2026-54637 (Dragonfly is an open source P2P-based file distribution and image acce ...)
TODO: check
CVE-2026-54561 (MCP Memory Keeper is an MCP server for persistent context management i ...)
@@ -832,13 +832,13 @@ CVE-2026-54254 (Cyberdrop-DL is a bulk asynchronous downloader for multiple file
CVE-2026-54251 (netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway ...)
TODO: check
CVE-2026-54168 (Pipelines-as-Code is a CI/CD system that lets users define Tekton pipe ...)
- TODO: check
+ NOT-FOR-US: Pipelines-as-Code
CVE-2026-54167 (Pipelines-as-Code is a CI/CD system that lets users define Tekton pipe ...)
- TODO: check
+ NOT-FOR-US: Pipelines-as-Code
CVE-2026-54077 (ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE s ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-54076 (ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026- ...)
- TODO: check
+ NOT-FOR-US: ArcadeDB
CVE-2026-54050 (Sakai is a Collaboration and Learning Environment (CLE). From 23.0 unt ...)
TODO: check
CVE-2026-53966 (XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10. ...)
@@ -858,27 +858,27 @@ CVE-2026-53658 (Fabric CA is a Certificate Authority for Hyperledger Fabric. Pri
CVE-2026-53459 (Bambuddy is a self-hosted print archive and management system for Bamb ...)
TODO: check
CVE-2026-52828 (Kimai is an open-source time tracking application. Prior to 2.58.0, Ex ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52827 (Kimai is an open-source time tracking application. Prior to 2.59.0, th ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52826 (Kimai is an open-source time tracking application. Prior to 2.57.0, GE ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52825 (Kimai is an open-source time tracking application. Prior to 2.58.0, PO ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52824 (Kimai is an open-source time tracking application. Prior to 2.58.0, th ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52823 (Kimai is an open-source time tracking application. Prior to 2.58.0, Ti ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52822 (Kimai is an open-source time tracking application. Prior to 2.58.0, PA ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52821 (Kimai is an open-source time tracking application. Prior to 2.57.0, GE ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52820 (Kimai is an open-source time tracking application. Prior to 2.57.0, PA ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52819 (Kimai is an open-source time tracking application. Prior to 2.57.0, th ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52724 (Kuma is a modern Envoy-based service mesh that can run on every cloud ...)
- TODO: check
+ NOT-FOR-US: Kimai
CVE-2026-52484 (An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows a ...)
TODO: check
CVE-2026-50166 (Kuma is a modern Envoy-based service mesh that can run on every cloud ...)
@@ -890,41 +890,41 @@ CVE-2026-49446 (Cosmos provides users the ability self-host a home server by act
CVE-2026-49254 (Dragonfly is an open source P2P-based file distribution and image acce ...)
TODO: check
CVE-2026-48987 (pyLoad is a free and open-source download manager written in Python. P ...)
- TODO: check
+ - pyload <itp> (bug #1001980)
CVE-2026-48737 (pyLoad is a free and open-source download manager written in Python. P ...)
- TODO: check
+ - pyload <itp> (bug #1001980)
CVE-2026-48722 (Nextflow is a DSL for data-driven computational pipelines. From 25.09. ...)
TODO: check
CVE-2026-48717 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-47780 (free5GC is an open-source implementation of the 5G core network. In 4. ...)
NOT-FOR-US: Free5GC
CVE-2026-47426 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-47424 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-46623 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-46619 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-46498 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-46495 (OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the J ...)
- TODO: check
+ NOT-FOR-US: OpenDJ
CVE-2026-46488 (motionEye (mEye) is an online interface for a piece of software called ...)
- TODO: check
+ NOT-FOR-US: motionEye
CVE-2026-45794 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-45579 (DIRAC is an interware, meaning a software framework for distributed co ...)
- TODO: check
+ NOT-FOR-US: DIRAC
CVE-2026-45052 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-45051 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-45048 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-44793 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-44778 (Inspektor Gadget is a set of tools and framework for data collection a ...)
TODO: check
CVE-2026-44300 (OpenCost provides cost monitoring for Kubernetes workloads and cloud c ...)
@@ -932,13 +932,13 @@ CVE-2026-44300 (OpenCost provides cost monitoring for Kubernetes workloads and c
CVE-2026-44282 (Decidim is a participatory democracy framework. Prior to 0.32.0, a low ...)
TODO: check
CVE-2026-44203 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-44202 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-44163 (fluent-plugin-opentelemetry is a Fluentd input and output plugin for f ...)
TODO: check
CVE-2026-41573 (Open Access Management (OpenAM) is an access management solution. Prio ...)
- TODO: check
+ NOT-FOR-US: OpenAM
CVE-2026-40058 (CrowdStrike released a security update to address a vulnerability in t ...)
NOT-FOR-US: CrowdStrike
CVE-2026-39919 (Ghostscript before 10.08.0 contains a heap-based buffer overflow vulne ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54788a690f41f623b02f5b6214def493b9f93ffb
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54788a690f41f623b02f5b6214def493b9f93ffb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260916/0595a53c/attachment.htm>
More information about the debian-security-tracker-commits
mailing list