[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Mon Sep 28 21:26:59 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
52592448 by Salvatore Bonaccorso at 2026-09-28T22:26:38+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -76,9 +76,9 @@ CVE-2026-87752 (Improper neutralization of input during web page generation ('cr
 CVE-2026-87114 (A flaw was found in kube-compare. When processing a 'container://' ref ...)
 	NOT-FOR-US: kube-compare
 CVE-2026-86595 (Improper neutralization of special elements used in an SQL command ('S ...)
-	TODO: check
+	NOT-FOR-US: enVision
 CVE-2026-86530 (BUFFALO Wi-Fi products handle some web form input improperly to assemb ...)
-	TODO: check
+	NOT-FOR-US: BUFFALO
 CVE-2026-86507 (Improper neutralization of input in Apache Roller 6.1.5 allows an anon ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-86335 (Missing Authorization in imageDownload in Canonical LXD before 5.0.10, ...)
@@ -88,31 +88,31 @@ CVE-2026-86334 (Path traversal in the CLI client image export and copy functiona
 	- lxd <removed>
 	NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq
 CVE-2026-86330 (An OS command injection flaw was found in the set_hostname_internal fu ...)
-	TODO: check
+	NOT-FOR-US: NooBaa
 CVE-2026-86102 (An OS command injection vulnerability in the WatchGuard AP internal AP ...)
 	NOT-FOR-US: WatchGuard
 CVE-2026-85134 (Unrestricted upload of file with dangerous type vulnerability in Bimse ...)
-	TODO: check
+	NOT-FOR-US: eBA Plus Document and Workflow Management System:
 CVE-2026-84894 (In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop  ...)
 	TODO: check
 CVE-2026-82969 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: eBA Plus Document and Workflow Management System:
 CVE-2026-82936 (mH-DEVELOPER smart home module is vulnerable to Denial of Service due  ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82935 (mH-DEVELOPER smart home module ships with an end-of-life, unsupported  ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82933 (mH-DEVELOPER smart home module sends its web interface and API traffic ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82932 (mH-DEVELOPER smart home module does not load any firewall rules at sta ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82930 (mH-DEVELOPER smart home module does not verify tokens in its authoriza ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82929 (mH-DEVELOPER smart home module uses the same hard-coded SSH host keys  ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82928 (mH-DEVELOPER smart home module contains a hardcoded SSH public key in  ...)
-	TODO: check
+	NOT-FOR-US: mH-DEVELOPER smart home module
 CVE-2026-82915 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
-	TODO: check
+	NOT-FOR-US: eBA Plus Document and Workflow Management System
 CVE-2026-82546 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82387 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -144,13 +144,13 @@ CVE-2026-82375 (Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows
 CVE-2026-82348 (Authorization Bypass Through User-Controlled Key in Apache Roller 6.1. ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-82326 (Improper neutralization of input during web page generation ('cross-si ...)
-	TODO: check
+	NOT-FOR-US: Enocta Platform
 CVE-2026-82323 (Authorization bypass through User-Controlled key vulnerability in Enoc ...)
-	TODO: check
+	NOT-FOR-US: Enocta Platform
 CVE-2026-81867 (A Deserialization of Untrusted Data vulnerability in the JavaScript Ta ...)
-	TODO: check
+	NOT-FOR-US: Google Cloud Application Integration
 CVE-2026-81375 (A Confused Deputy vulnerability in the EmailTask component in Google C ...)
-	TODO: check
+	NOT-FOR-US: Google Cloud Application Integration
 CVE-2026-80359 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2026-80358 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
@@ -158,21 +158,21 @@ CVE-2026-80358 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2
 CVE-2026-80357 (Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.20 ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2026-7172 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the followi ...)
-	TODO: check
+	NOT-FOR-US: TPVEnlanube
 CVE-2026-7171 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the followi ...)
-	TODO: check
+	NOT-FOR-US: TPVEnlanube
 CVE-2026-7170 (Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the followi ...)
-	TODO: check
+	NOT-FOR-US: TPVEnlanube
 CVE-2026-78424 (Improper parameter handling in NeuVector allows any authenticated user ...)
-	TODO: check
+	NOT-FOR-US: NeuVector
 CVE-2026-75600 (FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticat ...)
-	TODO: check
+	NOT-FOR-US: FreePBX
 CVE-2026-73642 (Dayforce Payroll is vulnerable to Path Traversal in file download func ...)
-	TODO: check
+	NOT-FOR-US: Dayforce Payroll
 CVE-2026-73641 (Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. ...)
-	TODO: check
+	NOT-FOR-US: Dayforce Payroll
 CVE-2026-73640 (Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in pa ...)
-	TODO: check
+	NOT-FOR-US: Dayforce Payroll
 CVE-2026-70413 (Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s)  ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2026-59563 (Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC co ...)
@@ -182,33 +182,33 @@ CVE-2026-58464
 CVE-2026-58463
 	REJECTED
 CVE-2026-55160 (Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75c ...)
-	TODO: check
+	NOT-FOR-US: Stringer
 CVE-2026-55157 (Token Optimizer MCP measures token savings per AI coding agent, optimi ...)
-	TODO: check
+	NOT-FOR-US: Token Optimizer MCP
 CVE-2026-55156 (Token Optimizer MCP measures token savings per AI coding agent, optimi ...)
-	TODO: check
+	NOT-FOR-US: Token Optimizer MCP
 CVE-2026-55096 (fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the ...)
-	TODO: check
+	NOT-FOR-US: fast-mcp-telegram
 CVE-2026-54710 (FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7 ...)
-	TODO: check
+	NOT-FOR-US: FreePBX
 CVE-2026-54708 (FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7 ...)
-	TODO: check
+	NOT-FOR-US: FreePBX
 CVE-2026-54675 (FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5 ...)
-	TODO: check
+	NOT-FOR-US: FreePBX
 CVE-2026-54674 (FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7 ...)
-	TODO: check
+	NOT-FOR-US: FreePBX
 CVE-2026-54160 (Network UPS Tools is a collection of programs which provide a common i ...)
 	TODO: check
 CVE-2026-52749 (The Kaon AR2140X router improperly issues session cookies in responses ...)
-	TODO: check
+	NOT-FOR-US: Kaon
 CVE-2026-52748 (The Kaon AR2140X router contains a vulnerability where the backup func ...)
-	TODO: check
+	NOT-FOR-US: Kaon
 CVE-2026-4556 (Exam4 is affected by a local privilege escalation vulnerability in the ...)
 	TODO: check
 CVE-2026-49994 (Bluehood monitors local bluetooth activity. Prior to version 0.7.1, wh ...)
-	TODO: check
+	NOT-FOR-US: Bluehood
 CVE-2026-48100 (Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory ...)
-	TODO: check
+	NOT-FOR-US: Payy
 CVE-2026-45562 (FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, ...)
 	TODO: check
 CVE-2026-19759 (An Incorrect Authorization vulnerabilityin the task configuration in G ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5259244804475605caf09033068da3f1620f2bc0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5259244804475605caf09033068da3f1620f2bc0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260928/962a5b24/attachment.htm>

More information about the debian-security-tracker-commits mailing list