[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update

Tue Sep 29 08:14:41 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5c54bead by security tracker role at 2026-09-29T07:14:33+00:00
automatic NOT-FOR-US entries update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3,39 +3,39 @@ CVE-2026-97685 (An authenticated LimeSurvey Community Edition 7.3.0 user allowed
 CVE-2026-96760 (Authlib (v1.7.2 and below) contains a signature verification bypass vu ...)
 	TODO: check
 CVE-2026-96326 (The HT Contact Form \u2013 Drag & Drop Form Builder for WordPress plug ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-93355 (LiteLLM contains a weak authentication vulnerability that allows an at ...)
 	TODO: check
 CVE-2026-91096 (In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl ...)
-	TODO: check
+	NOT-FOR-US: Meta software not packaged in Debian
 CVE-2026-91095 (In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransact ...)
-	TODO: check
+	NOT-FOR-US: Meta software not packaged in Debian
 CVE-2026-87741 (The ConvertPlus plugin for WordPress is vulnerable to Deserialization  ...)
-	TODO: check
+	NOT-FOR-US: WordPress plugin
 CVE-2026-86950 (An out-of-bounds write issue was addressed with improved bounds checki ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2026-86158 (Missing authentication in the local .NET backend (Fiddler.WebUi) of Pr ...)
-	TODO: check
+	NOT-FOR-US: Progress Software
 CVE-2026-86157 (Exposure of privileged IPC functionality in Progress Telerik Fiddler E ...)
-	TODO: check
+	NOT-FOR-US: Progress Software
 CVE-2026-84895 (In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::c ...)
-	TODO: check
+	NOT-FOR-US: Meta software not packaged in Debian
 CVE-2026-18747 (The MCUmgr SMP-over-console transport decodes a base64 frame, reads a  ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18746 (parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c hand ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18417 (The native BSD-socket layer recorded a pending asynchronous socket err ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18416 (The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/co ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18415 (ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the  ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18414 (The ADC API requires each driver to reject a sampling sequence whose d ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-18413 (The ADC API requires each driver to reject a sampling sequence whose d ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-16513 (The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys ...)
-	TODO: check
+	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token as `#` fo ...)
 	TODO: check
 CVE-2026-102414 (pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...)
@@ -133,11 +133,11 @@ CVE-2026-102241 (A vulnerability was determined in Netcore NAP930 0.1.241010.141
 CVE-2026-102240 (A vulnerability was found in Netcore NAP930 0.1.241010.141410. This af ...)
 	TODO: check
 CVE-2026-102006 (In Wind River VxWorks 7 prior to 26.09, specific system call arguments ...)
-	TODO: check
+	NOT-FOR-US: WindRiver
 CVE-2026-102005 (Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under s ...)
-	TODO: check
+	NOT-FOR-US: WindRiver
 CVE-2026-102004 (Wind River VxWorks 7 prior to 26.09, specific system call arguments ca ...)
-	TODO: check
+	NOT-FOR-US: WindRiver
 CVE-2026-101918 (PyJWT is a Python implementation of JSON Web Token standards. From 2.0 ...)
 	TODO: check
 CVE-2026-101917 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
@@ -169,7 +169,7 @@ CVE-2026-101278 (A weakness has been identified in Trusted Domain Project OpenDM
 CVE-2026-101277 (A security flaw has been discovered in Trusted Domain Project OpenDKIM ...)
 	TODO: check
 CVE-2026-101265 (A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. Th ...)
-	TODO: check
+	NOT-FOR-US: Intelbras
 CVE-2026-101264 (A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted ...)
 	TODO: check
 CVE-2026-101263 (A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue af ...)
@@ -209,9 +209,9 @@ CVE-2026-101139 (A vulnerability was detected in Webkul Bagisto up to 2.4.6. Thi
 CVE-2026-101093 (Cotonti through 1.0.0 contains a cross-site request forgery vulnerabil ...)
 	TODO: check
 CVE-2026-101092 (SiYuan before v3.8.4 fails to enforce publish-access checks in the get ...)
-	TODO: check
+	NOT-FOR-US: SiYuan
 CVE-2026-101091 (SiYuan versions before v3.8.4 fail to properly validate SQL statements ...)
-	TODO: check
+	NOT-FOR-US: SiYuan
 CVE-2026-100392 (InvoicePlane is a self-hosted open source application for managing inv ...)
 	TODO: check
 CVE-2026-100371 (InvoicePlane is a self-hosted open source application for managing inv ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c54bead1797b710bd1f546d316d63efaa5ebd03

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c54bead1797b710bd1f546d316d63efaa5ebd03
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/9dc02afc/attachment.htm>
