[Git][security-tracker-team/security-tracker][master] Process some NFUs

Tue Sep 29 21:28:59 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00fcd964 by Salvatore Bonaccorso at 2026-09-29T22:28:18+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -10,15 +10,15 @@ CVE-2026-97711 (Serialize JavaScript serializes JavaScript values to a superset
 CVE-2026-97395 (Apache Polaris allows an authenticated principal with permission to cr ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-96440 (Improper Limitation of a Pathname to a Restricted Directory\uff08Path  ...)
-	TODO: check
+	NOT-FOR-US: Flowring Agentflow
 CVE-2026-96431 (Unrestricted Upload of File with Dangerous Type in the /WebAgenda/down ...)
-	TODO: check
+	NOT-FOR-US: Flowring Agentflow
 CVE-2026-96430 (Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API e ...)
-	TODO: check
+	NOT-FOR-US: Flowring Agentflow
 CVE-2026-96429 (SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint o ...)
-	TODO: check
+	NOT-FOR-US: Flowring Agentflow
 CVE-2026-96428 (SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of ...)
-	TODO: check
+	NOT-FOR-US: Flowring Agentflow
 CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a symlink  ...)
 	TODO: check
 CVE-2026-95509 (Strings optimized for Latin-1 displaying Latin-1 characters cause inco ...)
@@ -78,13 +78,13 @@ CVE-2026-8066 (A directory traversal vulnerability in the file upload functional
 CVE-2026-8065 (An authentication bypass vulnerability in the firmware update endpoint ...)
 	NOT-FOR-US: Hitachi Energy
 CVE-2026-87748 (Missing Authorization vulnerability in Interprobe Information Technolo ...)
-	TODO: check
+	NOT-FOR-US: Qorela DC
 CVE-2026-86450 (Insertion of sensitive information into sent data vulnerability in Par ...)
-	TODO: check
+	NOT-FOR-US: DetaWix Mobile Web Portal
 CVE-2026-86035 (Weblate is a web-based continuous localization platform used to manage ...)
 	TODO: check
 CVE-2026-85520 (Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerab ...)
-	TODO: check
+	NOT-FOR-US: PrestaShop module
 CVE-2026-84842 (IBM Guardium Data Protection 12.2 is vulnerable to path traversal and  ...)
 	NOT-FOR-US: IBM
 CVE-2026-84739 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
@@ -102,7 +102,7 @@ CVE-2026-84414 (IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated a
 CVE-2026-84154 (A Code Injection vulnerability affecting GEOVIA Geospatial Data Manage ...)
 	NOT-FOR-US: Dassault Systemes
 CVE-2026-82973 (Improper neutralization of CRLF sequences in IMAP command construction ...)
-	TODO: check
+	NOT-FOR-US: psyb0t/docker-mailbox
 CVE-2026-82804 (The scriptPath parameter is incorporated into a /bin/sh -c command wit ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-81569 (An improper authorization vulnerability exists in the handling of sub- ...)
@@ -110,13 +110,13 @@ CVE-2026-81569 (An improper authorization vulnerability exists in the handling o
 CVE-2026-7395 (Asset Suite allows unauthenticated users to access HTTPPublishAdapterT ...)
 	NOT-FOR-US: Hitachi Energy
 CVE-2026-7193 (A vulnerability relating to the use of predefined credentials in the D ...)
-	TODO: check
+	NOT-FOR-US: Dbit T-CPE301K 4G WiFi mini-router
 CVE-2026-7192 (A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G W ...)
-	TODO: check
+	NOT-FOR-US: Dbit T-CPE301K 4G WiFi mini-router
 CVE-2026-78214 (An authentication bypass vulnerability exists in the protection of Act ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-77177 (Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backe ...)
-	TODO: check
+	NOT-FOR-US: Open GenAI Stack (aka ogx-ai)
 CVE-2026-76875 (PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vul ...)
 	TODO: check
 CVE-2026-76720 (A vulnerability in HPE OneView can be remotely exploited to cause a UR ...)
@@ -162,11 +162,11 @@ CVE-2026-4034 (Injection Vulnerability in Tibco Administrator version 5.13.0 & p
 CVE-2026-49243 (Webmin is a web-based system administration tool for Unix-like servers ...)
 	TODO: check
 CVE-2026-41875 (Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config ...)
-	TODO: check
+	NOT-FOR-US: Quick.Cart
 CVE-2026-22101 (The access to the service menu is obfuscated, but possible with only p ...)
-	TODO: check
+	NOT-FOR-US: EVbee
 CVE-2026-22094 (The firmware for the EVbee DC-80 has a weak hardcoded root password, w ...)
-	TODO: check
+	NOT-FOR-US: EVbee
 CVE-2026-19743 (Improper path validation in the local IPC service of TeamViewer Full C ...)
 	NOT-FOR-US: TeamViewer
 CVE-2026-19547 (Ghostscript for Windows is vulnerable to local privilege escalation th ...)
@@ -184,13 +184,13 @@ CVE-2026-102831 (JupyterLab is an extensible environment for interactive and rep
 CVE-2026-102830 (JupyterLab is an extensible environment for interactive and reproducib ...)
 	TODO: check
 CVE-2026-102829 (simple-git, an interface for running git commands in any node.js appli ...)
-	TODO: check
+	NOT-FOR-US: simple-git
 CVE-2026-102828 (simple-git, an interface for running git commands in any node.js appli ...)
-	TODO: check
+	NOT-FOR-US: simple-git
 CVE-2026-102827 (simple-git, an interface for running git commands in any node.js appli ...)
-	TODO: check
+	NOT-FOR-US: simple-git
 CVE-2026-102826 (simple-git, an interface for running git commands in any node.js appli ...)
-	TODO: check
+	NOT-FOR-US: simple-git
 CVE-2026-102825 (Russh is a Rust SSH client and server library. Prior to 0.62.6, the US ...)
 	TODO: check
 CVE-2026-102824 (Russh is a Rust SSH client and server library. Prior to 0.63.0, the hy ...)
@@ -204,13 +204,13 @@ CVE-2026-102821 (Russh is a Rust SSH client and server library. Prior to 0.63.2,
 CVE-2026-102820 (pageant provides a [PageantStream] type that implements [AsyncRead] an ...)
 	TODO: check
 CVE-2026-102811 (Marmite through 0.4.2 contains missing authentication in the developme ...)
-	TODO: check
+	NOT-FOR-US: Marmite
 CVE-2026-102810 (Marmite through 0.4.2 contains a path traversal vulnerability in the d ...)
-	TODO: check
+	NOT-FOR-US: Marmite
 CVE-2026-102809 (PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation ...)
-	TODO: check
+	NOT-FOR-US: PX4 Autopilot
 CVE-2026-102808 (PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulne ...)
-	TODO: check
+	NOT-FOR-US: PX4 Autopilot
 CVE-2026-102807 (OpenClaw before 2026.9.4 contains an incorrect authorization vulnerabi ...)
 	NOT-FOR-US: OpenClaw
 CVE-2026-102806 (OpenClaw before 2026.9.5 contains an incorrect authorization vulnerabi ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fcd964dfe4ce68a3c40992c7e56b0b7a0f2f41

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00fcd964dfe4ce68a3c40992c7e56b0b7a0f2f41
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/ef6de5f7/attachment.htm>
