[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update

Salvatore Bonaccorso (@carnil) carnil at debian.org
Sat Sep 26 08:13:55 BST 2026



Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
129c7e18 by security tracker role at 2026-09-26T07:13:48+00:00
automatic NOT-FOR-US entries update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -17,33 +17,33 @@ CVE-2026-96875 (Improper neutralization of input during web page generation ('cr
 CVE-2026-96795 (Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exp ...)
 	TODO: check
 CVE-2026-96533 (The Testimonials Widget WordPress plugin through 4.0.4 does not valida ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96532 (The Testimonials Widget WordPress plugin through 4.0.4 does not perfor ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96531 (The Optimole  WordPress plugin before 4.2.13 does not escape unrecogni ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96526 (The MCP Server for WordPress  WordPress plugin before 1.8.2 does not p ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96525 (The MCP Server for WordPress  WordPress plugin before 1.8.2 does not p ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-96524 (The MCP Server for WordPress  WordPress plugin before 1.8.2 does not c ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-92411 (The WP Delicious  WordPress plugin before 1.10.8 does not validate or  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-89237 (The Bluff Post WordPress plugin through 1.1.1 does not sanitise and es ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-88003 (InvoicePlane is a self-hosted open source application for managing inv ...)
 	TODO: check
 CVE-2026-86066 (Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_at ...)
 	TODO: check
 CVE-2026-85081 (The File Manager WordPress plugin before 8.0.5, FileOrganizer  WordPre ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-84097 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not sani ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-84096 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not perf ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-84095 (The wp-review-slider-pro WordPress plugin before 12.7.12 does not perf ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-7800
 	REJECTED
 CVE-2026-7799
@@ -93,165 +93,165 @@ CVE-2026-45235
 CVE-2026-45234
 	REJECTED
 CVE-2026-19708 (The File Manager WordPress plugin before 8.0.5 does not prevent unauth ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-18143 (The Request a Quote for WooCommerce plugin for WordPress is vulnerable ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-16591 (The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize a ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-15273 (The Automatic.css plugin for WordPress is vulnerable to Stored Cross-S ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-11871 (The Team Members  WordPress plugin through 9.2 does not perform any au ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-10758 (Esri LERC is an open-source image or raster format which supports rapi ...)
 	TODO: check
 CVE-2026-100599 (OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configur ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100598 (OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Sign ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100597 (OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a t ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100596 (OpenClaw versions before 2026.7.1 fail to properly authorize non-owner ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100595 (OpenClaw versions before 2026.7.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100594 (OpenClaw versions before 2026.7.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100593 (OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100592 (OpenClaw is an agent gateway distributed via npm. In versions >= 2026. ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100591 (OpenClaw is an npm-distributed agent gateway. In versions before 2026. ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100590 (OpenClaw before 2026.7.1 contains an authorization bypass vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100589 (OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100588 (OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100587 (OpenClaw versions before 2026.7.1 fail to properly validate owner auth ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100586 (OpenClaw Codex before 2026.7.1 fails to properly enforce owner authori ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100585 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100584 (OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100583 (OpenClaw Discord versions before 2026.7.1 contain an authorization byp ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100582 (OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @opencl ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100581 (OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleart ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100580 (OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles c ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100579 (OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts r ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100578 (OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict ow ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100577 (OpenClaw versions before 2026.8.1 fail to validate video asset URLs re ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100576 (OpenClaw versions before 2026.8.1 contain a server-side request forger ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100575 (OpenClaw Slack versions before 2026.8.1 fail to properly enforce sende ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100574 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-si ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100573 (OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100572 (OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100571 (OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100570 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100569 (OpenClaw is an npm-distributed application. In versions >= 2026.4.25 a ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100568 (OpenClaw versions before 2026.8.1 fail to properly restrict access to  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100567 (OpenClaw is an agent gateway distributed as the npm package 'openclaw' ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100566 (OpenClaw LINE versions before 2026.8.1 contain an access control vulne ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100564 (OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formu ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100563 (OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100562 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100561 (OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100560 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100559 (OpenClaw versions before 2026.8.1 contain a command parser vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100558 (OpenClaw versions before 2026.8.1 contain a resource exhaustion vulner ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100557 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100556 (OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 co ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100555 (OpenClaw is an npm-distributed gateway application. In versions >= 202 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100554 (OpenClaw (npm package 'openclaw') versions >= 2026.5.12 and < 2026.8.1 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100553 (OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100552 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly e ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100551 (OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce s ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100550 (OpenClaw (npm package 'openclaw') before 2026.8.1 contains an access-c ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100549 (OpenClaw versions before 2026.8.1 contain a path traversal vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100548 (OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100547 (OpenClaw is a coding agent distributed as the npm package `openclaw`.  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100546 (OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and < 2026.9.2  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100545 (OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100544 (openclaw's @openclaw/voice-call package before 2026.8.1 launches the c ...)
 	TODO: check
 CVE-2026-100543 (OpenClaw (npm package openclaw) before 2026.8.1 could include determin ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100542 (OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100541 (OpenClaw's Matrix integration (npm package @openclaw/matrix) versions  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100540 (OpenClaw Feishu before 2026.8.1 fails to validate whether a configured ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100539 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memo ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100538 (OpenClaw (npm package 'openclaw') before 2026.8.1 does not apply the o ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100537 (OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the o ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100536 (OpenClaw versions before 2026.8.1 fail to validate all source fields i ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100535 (OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100534 (OpenClaw versions before 2026.8.1 contain an authorization bypass vuln ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100533 (OpenClaw versions before 2026.8.1 contain a path traversal vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100532 (@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login to ...)
 	TODO: check
 CVE-2026-100531 (The @openclaw/slack npm package before 2026.8.1 contains an authorizat ...)
 	TODO: check
 CVE-2026-100530 (OpenClaw versions before 2026.8.1 fail to bind working directory conte ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100529 (OpenClaw versions before 2026.8.1 contain an authorization scope widen ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100528 (OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-par ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100527 (OpenClaw before 2026.8.2 contains a denial of service vulnerability in ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100526 (OpenClaw's Discord integration (npm package @openclaw/discord) before  ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100525 (The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prom ...)
-	TODO: check
+	NOT-FOR-US: OpenClaw
 CVE-2026-100524 (Cotonti through 1.0.0 contains a cross-site request forgery vulnerabil ...)
 	TODO: check
 CVE-2026-100523 (Cotonti through 1.0.0 contains an open redirect vulnerability in messa ...)
@@ -289,19 +289,19 @@ CVE-2026-100388 (RustDesk versions before 1.5.0 fail to properly validate file t
 CVE-2026-100387 (pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerab ...)
 	TODO: check
 CVE-2026-100383 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-100382 (Improper Neutralization of Special Elements used in an OS Command ('OS ...)
 	TODO: check
 CVE-2026-100381 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
 	TODO: check
 CVE-2026-100380 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-100379 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
 	TODO: check
 CVE-2026-100378 (Missing Authorization vulnerability in Wikimedia Foundation Mediawiki  ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-100377 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
 CVE-2026-100376 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
 	TODO: check
 CVE-2026-100373 (OpenMetadata through 2.0.2 contains a server-side request forgery vuln ...)
@@ -315,7 +315,7 @@ CVE-2026-100368 (CliInvoke is a .NET library for invoking command-line programs,
 CVE-2026-100310 (GNU libextractor before 1.16 loads plugins from an untrusted search pa ...)
 	TODO: check
 CVE-2026-100208 (Integer overflow or wraparound in Microsoft Office Outlook allows an u ...)
-	TODO: check
+	NOT-FOR-US: Microsoft
 CVE-2026-XXXX [Heap OOB read/write in MS-MPPE key re-encryption]
 	- radsecproxy 1.11.4-1
 	NOTE: https://github.com/radsecproxy/radsecproxy/security/advisories/GHSA-wj29-mxmc-q98c



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/129c7e185fac26a6fc6a5b4e806e866e0244abae

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/129c7e185fac26a6fc6a5b4e806e866e0244abae
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260926/70ac65a7/attachment.htm>


More information about the debian-security-tracker-commits mailing list