[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
60fc5cb5 by Salvatore Bonaccorso at 2026-09-18T22:08:11+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -9,9 +9,9 @@ CVE-2026-93765 (Mongoid contains an unsafe reflection weakness in the document p
 CVE-2026-93764 (Mongoid may omit encryption rules for fields declared on embedded mode ...)
 	NOT-FOR-US: Mongoid
 CVE-2026-93763 (A protection mechanism failure in the object-document mapper's encrypt ...)
-	TODO: check
+	NOT-FOR-US: Mongoid
 CVE-2026-93762 (Mongoid contains an unsafe reflection weakness in the query path used  ...)
-	TODO: check
+	NOT-FOR-US: Mongoid
 CVE-2026-93761 (An inefficient regular expression complexity issue in the in-memory qu ...)
 	NOT-FOR-US: Mongoid
 CVE-2026-93760 (Mongoid does not restrict which query operators may come from caller-s ...)
@@ -24,7 +24,7 @@ CVE-2026-93753 (deepmerge through 4.3.1 contains a prototype poisoning vulnerabi
 	- node-deepmerge <unfixed>
 	NOTE: https://github.com/TehShrike/deepmerge/issues/273
 CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability in CSSS ...)
-	TODO: check
+	NOT-FOR-US: CSSOM
 CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability ...)
 	- node-uri-js <unfixed>
 	NOTE: https://github.com/garycourt/uri-js/issues/106
@@ -35,19 +35,19 @@ CVE-2026-93749 (source-map-js through 1.2.1 fails to validate the per-section of
 CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate security ...)
 	TODO: check
 CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the ScheduleS ...)
-	TODO: check
+	NOT-FOR-US: Azkaban
 CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the ratings a ...)
-	TODO: check
+	NOT-FOR-US: Mealie
 CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service vulnerability in the ...)
 	TODO: check
 CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference vulnerabi ...)
-	TODO: check
+	NOT-FOR-US: WinFsp
 CVE-2026-93688 (SGLang through 0.5.19 in prefill/decode disaggregation mode with Moonc ...)
-	TODO: check
+	NOT-FOR-US: SGLang
 CVE-2026-93687 (braces through 3.0.3 contains a stack overflow vulnerability in the re ...)
 	TODO: check
 CVE-2026-93685 (A flaw was found in the multicluster-observability-addon. A remote att ...)
-	TODO: check
+	NOT-FOR-US: multicluster-observability-addon (Red Hat Advanced Cluster Management for Kubernetes 2)
 CVE-2026-93676 (xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing ...)
 	TODO: check
 CVE-2026-93660 (SQLBot through 1.10.1 fails to verify dashboard ownership in update_re ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60fc5cb57924ad80da5e7e22bdc11da8868eda05

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/60fc5cb57924ad80da5e7e22bdc11da8868eda05
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260918/f60bf3fb/attachment.htm>