[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Tue Sep 29 14:51:36 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f040e580 by Salvatore Bonaccorso at 2026-09-29T15:49:18+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -13,7 +13,7 @@ CVE-2026-96760 (Authlib (v1.7.2 and below) contains a signature verification byp
 CVE-2026-96326 (The HT Contact Form \u2013 Drag & Drop Form Builder for WordPress plug ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-93355 (LiteLLM contains a weak authentication vulnerability that allows an at ...)
-	TODO: check
+	NOT-FOR-US: LiteLLM
 CVE-2026-91096 (In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl ...)
 	NOT-FOR-US: Meta software not packaged in Debian
 CVE-2026-91095 (In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransact ...)
@@ -49,43 +49,43 @@ CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token as
 CVE-2026-102414 (pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...)
 	TODO: check
 CVE-2026-102374 (GestSup versions before 3.2.62 contain a stored cross-site scripting v ...)
-	TODO: check
+	NOT-FOR-US: GestSup
 CVE-2026-102373 (GestSup versions before 3.2.62 fail to validate ticket ownership when  ...)
-	TODO: check
+	NOT-FOR-US: GestSup
 CVE-2026-102372 (GestSup versions before 3.2.62 fail to properly sanitize HTML email bo ...)
-	TODO: check
+	NOT-FOR-US: GestSup
 CVE-2026-102367 (mall4j through 4.0 contains an insufficient session expiration vulnera ...)
-	TODO: check
+	NOT-FOR-US: mall4jmall4j
 CVE-2026-102366 (mall4j through 4.0 contains an unrestricted file upload vulnerability  ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102365 (mall4j through 4.0 fails to enforce authorization checks on GET endpoi ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102364 (mall4j through 4.0 fails to validate the sysType field in sa-token ses ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102363 (mall4j through 4.0 contains a missing authentication vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102362 (mall4j through 4.0 fails to implement authentication controls on the D ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102361 (mall4j through 4.0 contains a missing authentication vulnerability in  ...)
-	TODO: check
+	NOT-FOR-US: mall4j
 CVE-2026-102335 (Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_conf ...)
-	TODO: check
+	NOT-FOR-US: Nginx Proxy Manager
 CVE-2026-102334 (Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authenticati ...)
-	TODO: check
+	NOT-FOR-US: Nginx Proxy Manager
 CVE-2026-102333 (httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP re ...)
 	TODO: check
 CVE-2026-102332 (Dozzle versions before 11.1.2 fail to sanitize container display names ...)
-	TODO: check
+	NOT-FOR-US: Dozzle
 CVE-2026-102297 (ZoneMinder before 1.38.4 fails to apply per-monitor access restriction ...)
 	TODO: check
 CVE-2026-102296 (ZoneMinder before 1.38.4 contains static buffer overflow vulnerabiliti ...)
 	TODO: check
 CVE-2026-102293 (A vulnerability was identified in realjerrytang tacomall 1.0.0. Impact ...)
-	TODO: check
+	NOT-FOR-US: realjerrytang tacomall
 CVE-2026-102292 (A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea ...)
-	TODO: check
+	NOT-FOR-US: coolbeans1212 MateisHomePage-Website
 CVE-2026-102290 (A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. Thi ...)
-	TODO: check
+	NOT-FOR-US: CodeCanyon Rocket LMS
 CVE-2026-102281 (Nest is a framework for building scalable Node.js server-side applicat ...)
 	TODO: check
 CVE-2026-102279 (Laravel is a web application framework. Prior to 12.69.0 and 13.30.0,  ...)
@@ -141,27 +141,27 @@ CVE-2026-102265 (PyJWT is a Python implementation of JSON Web Token standards. F
 	NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863
 	NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62 (2.14.0)
 CVE-2026-102264 (A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f ...)
-	TODO: check
+	NOT-FOR-US: mwasikz robo-cafe-rms
 CVE-2026-102263 (A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a0 ...)
-	TODO: check
+	NOT-FOR-US: mwasikz robo-cafe-rms
 CVE-2026-102261 (A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted i ...)
-	TODO: check
+	NOT-FOR-US: Camaleon CMS
 CVE-2026-102249 (A security flaw has been discovered in REBUILD up to 4.4.11. This vuln ...)
-	TODO: check
+	NOT-FOR-US: REBUILD
 CVE-2026-102248 (A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. Thi ...)
-	TODO: check
+	NOT-FOR-US: REBUILD
 CVE-2026-102247 (A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.2026060 ...)
-	TODO: check
+	NOT-FOR-US: FastAdmin
 CVE-2026-102245 (A weakness has been identified in MODSetter SurfSense up to 2.0.3. The ...)
-	TODO: check
+	NOT-FOR-US: MODSetter SurfSense
 CVE-2026-102244 (A security flaw has been discovered in MODSetter SurfSense up to 0.0.3 ...)
-	TODO: check
+	NOT-FOR-US: MODSetter SurfSense
 CVE-2026-102243 (A vulnerability was identified in MODSetter SurfSense up to 2.0.3. Thi ...)
-	TODO: check
+	NOT-FOR-US: MODSetter SurfSense
 CVE-2026-102241 (A vulnerability was determined in Netcore NAP930 0.1.241010.141410. Th ...)
-	TODO: check
+	NOT-FOR-US: Netcore
 CVE-2026-102240 (A vulnerability was found in Netcore NAP930 0.1.241010.141410. This af ...)
-	TODO: check
+	NOT-FOR-US: Netcore
 CVE-2026-102006 (In Wind River VxWorks 7 prior to 26.09, specific system call arguments ...)
 	NOT-FOR-US: WindRiver
 CVE-2026-102005 (Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under s ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f040e5800af55a28bb0539471fefcdd3be844b94

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f040e5800af55a28bb0539471fefcdd3be844b94
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/a717f78a/attachment.htm>

More information about the debian-security-tracker-commits mailing list