[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff (@jmm) jmm at debian.org
Sun Sep 27 22:08:12 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1e537e3 by Moritz Muehlenhoff at 2026-09-27T23:05:02+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -52,63 +52,63 @@ CVE-2026-15442 (In all builds that make use of (D)TLS, including default builds,
 	- wolfssl <unfixed>
 	NOTE: https://github.com/wolfSSL/wolfssl/pull/10863 (v5.9.4-stable)
 CVE-2026-101061 (utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-s ...)
-	TODO: check
+	NOT-FOR-US: utcp
 CVE-2026-101060 (python-utcp versions before 1.1.4 contain a server-side request forger ...)
-	TODO: check
+	NOT-FOR-US: utcp
 CVE-2026-101059 (utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field fro ...)
-	TODO: check
+	NOT-FOR-US: utcp
 CVE-2026-101058 (python-utcp (pip package utcp-http) before 1.1.12 does not verify whet ...)
-	TODO: check
+	NOT-FOR-US: utcp
 CVE-2026-101057 (utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the ...)
-	TODO: check
+	NOT-FOR-US: utcp
 CVE-2026-101056 (Cloudreve before 4.16.1 fails to revalidate share access when restorin ...)
-	TODO: check
+	NOT-FOR-US: Cloudreve
 CVE-2026-101051 (Cloudreve before 4.16.1 fails to properly sanitize file paths returned ...)
-	TODO: check
+	NOT-FOR-US: Cloudreve
 CVE-2026-101050 (Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token ...)
-	TODO: check
+	NOT-FOR-US: Heym
 CVE-2026-101049 (Heym before 0.0.53 fails to verify Slack request signatures when trigg ...)
-	TODO: check
+	NOT-FOR-US: Heym
 CVE-2026-101048 (Cloudreve before 4.17.0 registers the administrative node test endpoin ...)
-	TODO: check
+	NOT-FOR-US: Cloudreve
 CVE-2026-101047 (Fleet before 4.87.0 does not protect the two endpoints that serve in-h ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-101046 (Fleet before 4.89.0 contains an SQL injection vulnerability in the act ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-101045 (Fleet-maintained app install and uninstall scripts for macOS are gener ...)
-	TODO: check
+	NOT-FOR-US: Fleet
 CVE-2026-101044 (pacquet, the Rust package-manager component shipped in the pnpm npm pa ...)
-	TODO: check
+	- pnpm <itp> (bug #985669)
 CVE-2026-101043 (pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $ ...)
-	TODO: check
+	- pnpm <itp> (bug #985669)
 CVE-2026-101042 (Parse Server is an open-source backend server. In versions >= 9.0.0 <  ...)
 	NOT-FOR-US: Parse Server
 CVE-2026-101041 (The account recovery (password reset) functionality in the vulnerabili ...)
-	TODO: check
+	NOT-FOR-US: vulnerability-lookup
 CVE-2026-101033 (KitchenOwl through 0.7.10 fails to verify that category IDs belong to  ...)
-	TODO: check
+	NOT-FOR-US: KitchenOwl
 CVE-2026-101032 (navi through 2.24.0 fails to properly escape cheatsheet variable value ...)
-	TODO: check
+	NOT-FOR-US: navi
 CVE-2026-100875 (A vulnerability has been found in mathurvishal CloudClassroom-PHP-Proj ...)
-	TODO: check
+	NOT-FOR-US: CloudClassroom-PHP-Project
 CVE-2026-100874 (A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to ...)
-	TODO: check
+	NOT-FOR-US: CloudClassroom-PHP-Project
 CVE-2026-100873 (A vulnerability was detected in mathurvishal CloudClassroom-PHP-Projec ...)
-	TODO: check
+	NOT-FOR-US: CloudClassroom-PHP-Project
 CVE-2026-100872 (Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amoun ...)
-	TODO: check
+	NOT-FOR-US: Sylius
 CVE-2026-100871 (Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fa ...)
-	TODO: check
+	NOT-FOR-US: Sylius
 CVE-2026-100870 (Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 bu ...)
-	TODO: check
+	NOT-FOR-US: Sylius
 CVE-2026-100869 (Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment reque ...)
-	TODO: check
+	NOT-FOR-US: Sylius
 CVE-2026-100868 (Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to a ...)
-	TODO: check
+	NOT-FOR-US: Penpot
 CVE-2026-100867 (spaceship-prompt through 4.22.5 fails to sanitize control characters f ...)
-	TODO: check
+	NOT-FOR-US: spaceship-prompt
 CVE-2026-100866 (onefetch through 2.28.1 writes repository information field values to  ...)
-	TODO: check
+	NOT-FOR-US: oenfetch
 CVE-2026-100749 (Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in  ...)
 	NOT-FOR-US: Joomla
 CVE-2026-100748 (Joomla Extension - svenbluege.de - CSRF in various cart actions in Eve ...)
@@ -116,7 +116,7 @@ CVE-2026-100748 (Joomla Extension - svenbluege.de - CSRF in various cart actions
 CVE-2026-100747 (Joomla Extension - svenbluege.de - CSRF in image upload in Event Galle ...)
 	NOT-FOR-US: Joomla
 CVE-2026-100741 (Eval injection in the JScript event-script dispatcher in Progressive R ...)
-	TODO: check
+	NOT-FOR-US: hMailServer
 CVE-2026-XXXX [Infinite loops and heap OOB read when parsing malformed ASF headers]
 	- libmms <unfixed> (bug #1149047)
 CVE-2026-XXXX [unbounded list indices from a Word document reach a wild pointer dereference in wvAssembleSimplePAP]
@@ -1002,7 +1002,7 @@ CVE-2026-97878 (A vulnerability was identified in zhistaredu StarTraining up to
 CVE-2026-97877 (A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. ...)
 	NOT-FOR-US: zhistaredu StarTraining
 CVE-2026-97875 (Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin h ...)
-	TODO: check
+	NOT-FOR-US: Rojo
 CVE-2026-97871 (A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. Th ...)
 	NOT-FOR-US: Zhonglun CloudPos
 CVE-2026-97869 (A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1e537e314b683227ae7f56faf6582b9b45adfd4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1e537e314b683227ae7f56faf6582b9b45adfd4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260927/f801ede8/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list