[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Sep 29 20:16:04 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
606d9c2a by security tracker role at 2026-09-29T19:15:53+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -9,7 +9,7 @@ CVE-2026-97688 (urllib3 is an HTTP client library for Python. From 2.6.2 until 2
CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, ...)
TODO: check
CVE-2026-97395 (Apache Polaris allows an authenticated principal with permission to cr ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted Directory\uff08Path ...)
TODO: check
CVE-2026-96431 (Unrestricted Upload of File with Dangerous Type in the /WebAgenda/down ...)
@@ -25,59 +25,59 @@ CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a sy
CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters cause inco ...)
TODO: check
CVE-2026-94954 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-93332 (Improper access control in the partial connection API in Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-93330 (Improper rule enforcement in the PAM Active Directory provider in Devo ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-92371 (TeamViewer Full Client and Host for Linux prior version 15.82 contains ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92370 (An improper access control vulnerability in TeamViewer Full Client, Ho ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92369 (TeamViewer Full Client and Host prior to version 15.82 on Windows cont ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92368 (TeamViewer Full Client and Host for Linux and macOS prior version 15.8 ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-92232 (Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter vi ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92231 (Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter vi ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92227 (Joomla! Core - [20260914] - Core - MFA Authentication Bypass through r ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92226 (Joomla! Core - [20260913] - Core - Improper ACL checks for varous webs ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92225 (Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0- ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92224 (Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Jooml ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92223 (Joomla! Core - [20260910] - Core - Improper ACL checks for workflow st ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-92222 (Joomla! Core - [20260909] - Core - SSRF vectors in various core extens ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90918 (Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Jooml ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90917 (Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90916 (Joomla! Core - [20260906] - Core - Improper ACL checks in content hist ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90915 (Joomla! Core - [20260905] - Core - Arbitrary directory deletion via ca ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90914 (Joomla! Core - [20260904] - Core - XSS in the generic media output lay ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90913 (Joomla! Core - [20260903] - Core - Improper ACL checks for access leve ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90907 (Joomla! Core - [20260902] - Core - Unauthorized user account creation ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-90906 (Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1 ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-8937 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-8067 (An improper authorization vulnerability in the end-of-life versions of ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-8066 (A directory traversal vulnerability in the file upload functionality o ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-8065 (An authentication bypass vulnerability in the firmware update endpoint ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-87748 (Missing Authorization vulnerability in Interprobe Information Technolo ...)
TODO: check
CVE-2026-86450 (Insertion of sensitive information into sent data vulnerability in Par ...)
@@ -87,79 +87,79 @@ CVE-2026-86035 (Weblate is a web-based continuous localization platform used to
CVE-2026-85520 (Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerab ...)
TODO: check
CVE-2026-84842 (IBM Guardium Data Protection 12.2 is vulnerable to path traversal and ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84739 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-84440 (IBM Guardium Data Protection 12.2 is vulnerable to command injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84436 (IBM Guardium Data Protection 12.2 is vulnerable to command injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84422 (IBM Guardium Data Protection 12.2 is vulnerable to command injection i ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84421 (IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authe ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84414 (IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacke ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84154 (A Code Injection vulnerability affecting GEOVIA Geospatial Data Manage ...)
- TODO: check
+ NOT-FOR-US: Dassault Systemes
CVE-2026-82973 (Improper neutralization of CRLF sequences in IMAP command construction ...)
TODO: check
CVE-2026-82804 (The scriptPath parameter is incorporated into a /bin/sh -c command wit ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81569 (An improper authorization vulnerability exists in the handling of sub- ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-7395 (Asset Suite allows unauthenticated users to access HTTPPublishAdapterT ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-7193 (A vulnerability relating to the use of predefined credentials in the D ...)
TODO: check
CVE-2026-7192 (A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G W ...)
TODO: check
CVE-2026-78214 (An authentication bypass vulnerability exists in the protection of Act ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-77177 (Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backe ...)
TODO: check
CVE-2026-76875 (PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vul ...)
TODO: check
CVE-2026-76720 (A vulnerability in HPE OneView can be remotely exploited to cause a UR ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76719 (A security vulnerability in HPE OneView may be exploited remotely to p ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76718 (A potential security vulnerability in HPE OneView can be exploited to ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76114 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73599 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73598 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73597 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73596 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73595 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73594 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-73593 (Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5. ...)
- TODO: check
+ NOT-FOR-US: Dell / EMC
CVE-2026-71899 (A missing authorization vulnerability exists in the `query-dynamic-sub ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71898 (An incorrect authorization check in Apache DolphinScheduler allows an ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71897 (An improper authorization check in Apache DolphinScheduler allows an a ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-68911 (Nicotine+ is a graphical client for the Soulseek peer-to-peer network. ...)
TODO: check
CVE-2026-66083 (The /datasources/unauth-datasource endpoint does not properly enforce ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65102 (NVIDIA DeepStream contains a vulnerability where an attacker could ca ...)
TODO: check
CVE-2026-63209 (compress provides various compression algorithms. Prior to version 1.1 ...)
TODO: check
CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-4034 (Injection Vulnerability in Tibco Administrator version 5.13.0 & prior ...)
- TODO: check
+ NOT-FOR-US: TIBCO
CVE-2026-49243 (Webmin is a web-based system administration tool for Unix-like servers ...)
TODO: check
CVE-2026-41875 (Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config ...)
@@ -169,7 +169,7 @@ CVE-2026-22101 (The access to the service menu is obfuscated, but possible with
CVE-2026-22094 (The firmware for the EVbee DC-80 has a weak hardcoded root password, w ...)
TODO: check
CVE-2026-19743 (Improper path validation in the local IPC service of TeamViewer Full C ...)
- TODO: check
+ NOT-FOR-US: TeamViewer
CVE-2026-19547 (Ghostscript for Windows is vulnerable to local privilege escalation th ...)
TODO: check
CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP reassemb ...)
@@ -177,9 +177,9 @@ CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP re
CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a race con ...)
TODO: check
CVE-2026-11796 (Asset Suite allows unauthenticated users to access PropertiesReloadSer ...)
- TODO: check
+ NOT-FOR-US: Hitachi Energy
CVE-2026-10518 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
- TODO: check
+ NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-102831 (JupyterLab is an extensible environment for interactive and reproducib ...)
TODO: check
CVE-2026-102830 (JupyterLab is an extensible environment for interactive and reproducib ...)
@@ -213,65 +213,65 @@ CVE-2026-102809 (PX4 Autopilot through 1.17.0 contains an uncontrolled stack all
CVE-2026-102808 (PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulne ...)
TODO: check
CVE-2026-102807 (OpenClaw before 2026.9.4 contains an incorrect authorization vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-102806 (OpenClaw before 2026.9.5 contains an incorrect authorization vulnerabi ...)
- TODO: check
+ NOT-FOR-US: OpenClaw
CVE-2026-102796 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
TODO: check
CVE-2026-102762 (The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102761 (NetX Duo's WebSocket client resets the unmasking cursor to the first ` ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102760 (When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102759 (NetX Secure TLS accepts an empty application-data record without verif ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102758 (The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102757 (An unprivileged, memory-protected ThreadX module can have the kernel r ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102730 (Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open( ...)
TODO: check
CVE-2026-102729 (`gx_binres_theme_load()` sizes its theme buffer for the theme it was a ...)
TODO: check
CVE-2026-102728 (Two client-side TLS/DTLS handshake parsers in NetX Secure read fields ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102727 (FTP Passive Data Connection Not Bound to the Authenticated Control Pee ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102726 (Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bou ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102725 (Out-of-bounds Read from Unvalidated MSRP Attribute List Length)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102724 (NULL Pointer Dereference When Evicting the Sole MSRP Attribute)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102723 (NULL Pointer Dereference on MSRP Attribute Table Exhaustion)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102722 (In the IPv4 PASV path, the FTP Client accepts whatever address was sen ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102721 (A TFTP server that answers with a short ERROR packet makes the client ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102720 (A DHCP server, or anyone on the LAN who answers a DISCOVER first, can ...)
TODO: check
CVE-2026-102719 (Predictable DTLS HelloVerifyRequest Cookie in NetX Secure)
TODO: check
CVE-2026-102718 (hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon do ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102716 (An unauthenticated client can drain the RTSP server's packet pool with ...)
TODO: check
CVE-2026-102715 (Any host on the LAN can send two mDNS records and make the responder w ...)
TODO: check
CVE-2026-102714 (`_nx_icmpv6_validate_options()` scans the option area with `while (len ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102713 (The TFTP server accepts a DATA datagram of any size. The dispatcher re ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102712 (On the first DTLS ClientHello, the parser copies a device-claimed sess ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102711 (Two issues in the ThreadX loadable-module loader, reached when a devic ...)
TODO: check
CVE-2026-102710 (Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_M ...)
TODO: check
CVE-2026-102709 (Improper validation of non-secure (NS) pointers in multiple TrustZone- ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102697 (Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorizatio ...)
TODO: check
CVE-2026-102677 (Electron is a framework for writing cross-platform desktop application ...)
@@ -345,9 +345,9 @@ CVE-2026-102473 (A flaw was found in dash. When built without libc fnmatch, the
CVE-2026-102437 (OS Command Injection in internal/gitcmd (git diff filter.clean/smudge ...)
TODO: check
CVE-2026-102425 (Joomla Extension - balbooa.com - Unauthenticated RCE via field shortco ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102424 (Joomla Extension - balbooa.com - Unauthenticated path traversal exfilt ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102371 (In wsl-pro-service before 0.1.19ubuntu3, the service component which r ...)
TODO: check
CVE-2026-102360 (A missing bounds check in the binary decoder in lib0, versions 0.2.1-0 ...)
@@ -355,39 +355,39 @@ CVE-2026-102360 (A missing bounds check in the binary decoder in lib0, versions
CVE-2026-102242 (Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots pa ...)
TODO: check
CVE-2026-101271 (OAuth credentials (access tokens) are valid for the entirety of their ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101270 (Malicious HTML content could be injected into the help texts of variou ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101269 (The mechanism binding API-uploaded files to the uploader's authenticat ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101268 (If an attacker is able to convince a victim on a specially crafted lin ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101267 (A missing permission check allowed low-privileged users with access to ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101266 (A logic flaw in the checkout flow allows users to bypass validations p ...)
- TODO: check
+ NOT-FOR-US: rami.io products
CVE-2026-101169 (In affected versions of Octopus Server, an authenticated user with per ...)
- TODO: check
+ NOT-FOR-US: Octopus Deploy
CVE-2026-101127 (Joomla Extension - balbooa.com - Unauthenticated upload filename store ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101126 (Joomla Extension - balbooa.com - File meta data tampering in Balbooa F ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-101112 (Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-100308 (Deserialization of untrusted data in the model loading component in Am ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-100289 (Missing authorization in the gateway network scan token API in Devolut ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100288 (Cleartext storage of sensitive information in the database in Devoluti ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100287 (Missing authorization in the attachment history API in Devolutions Ser ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100286 (Missing authorization in the data source settings API in Devolutions S ...)
- TODO: check
+ NOT-FOR-US: Devolutions
CVE-2026-100245 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100244 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100243 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
TODO: check
CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and Uncontrolled Resour ...)
@@ -395,7 +395,7 @@ CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and Uncontrolled
CVE-2026-100241 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
TODO: check
CVE-2026-100240 (Missing Authorization vulnerability in Wikimedia Foundation Mediawiki ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100238 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
TODO: check
CVE-2025-33207 (NVIDIA ConnectX and Bluefield contain a vulnerability in a control reg ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/606d9c2ab11e4f5cb606c7d11854859be40cc856
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/606d9c2ab11e4f5cb606c7d11854859be40cc856
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/e96d5592/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list