[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 30 08:15:29 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
cf69b610 by security tracker role at 2026-09-30T07:15:21+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,103 +1,103 @@
CVE-2026-97316 (The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97196 (Improper Validation of Unsafe Equivalence in Input vulnerability in Li ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96886 (The Course Booking System WordPress plugin before 7.0.9 does not restr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96649 (The Frontend Post Submission Manager Lite \u2013 Frontend Posting Word ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-96587 (The Viidure Android application embeds permanent, plaintext cloud stor ...)
TODO: check
CVE-2026-96274 (In Baicells Nova 430H, an unauthenticated device within radio range ca ...)
TODO: check
CVE-2026-94953 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-94952 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
- TODO: check
+ NOT-FOR-US: TOTOLINK
CVE-2026-94297 (The Media Library Organizer WordPress plugin before 2.1.4 does not ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94274 (The YayReviews WordPress plugin before 1.4.1 does not restrict access ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-94204 (The central cloud storage backend for the entire dashcam platform is m ...)
TODO: check
CVE-2026-93853 (Unverified ownership in Barman snapshot backup deletion allows a princ ...)
TODO: check
CVE-2026-93580 (The InPost PL WordPress plugin before 1.9.8 does not verify the authen ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92994 (The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92424 (The Content Egg WordPress plugin before 11.9.0 does not verify that a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91832 (The WP Mobile Menu WordPress plugin before 2.9 does not correctly ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91191 (The device's update mechanism includes conditions that allow unauthori ...)
TODO: check
CVE-2026-91072 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-91051 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not preven ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90953 (The Image Optimizer WordPress plugin before 1.7.7 does not enforce it ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-90441 (A missing authorization vulnerability in the wgagent management daemon ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-89294 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89193 (The Robin Image Optimizer WordPress plugin before 2.0.8 does not esca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-89190 (The Robin Image Optimizer WordPress plugin before 2.0.8 does not chec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88797 (The Vayu X WordPress theme before 1.0.6 does not perform any capabilit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88791 (The Safe Redirect Manager WordPress plugin before 2.3.0 does not prope ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87777 (The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86789 (The Connections Business Directory WordPress plugin through 10.4.67 do ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-86556 (There is an information disclosure vulnerability in ZTE U30 Air. Due t ...)
- TODO: check
+ NOT-FOR-US: ZTE
CVE-2026-86136 (A missing authorization vulnerability in the wgagent management daemon ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86134 (A NULL pointer dereference vulnerability in the WatchGuard Fireware OS ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86133 (An integer underflow vulnerability in the WatchGuard Fireware OS IKE d ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86132 (An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86131 (A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86128 (A NULL pointer dereference vulnerability in Fireware OS's NetFlow pack ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86105 (An improper authorization vulnerability in Fireware OS's Access Portal ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86104 (An uncontrolled resource consumption vulnerability in the Fireware OS ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-86101 (An improper authorization vulnerability in WatchGuard Fireware OS's SA ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-85576 (The All in One Files Upload WordPress plugin before 2.0.17 does not ha ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85573 (The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85415 (The Audio Player Block WordPress plugin before 1.6.3 does not validat ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-85001 (The EmbedPress WordPress plugin before 4.6.7 does not sanitise and es ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84409 (The device's update mechanism retrieves metadata for software updates ...)
TODO: check
CVE-2026-83560 (The New User Approve WordPress plugin before 3.2.10 does not properly ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-82127 (The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-81842 (An authenticated user with edit permission on one folder can move a li ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-81841 (Pausing a shared (public) dashboard did not revoke its access token fo ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-81433 (A stack-based buffer overflow vulnerability in WatchGuard Fireware OS' ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-81310 (Image Scanner Driver for Linux contains a link following vulnerability ...)
TODO: check
CVE-2026-80333 (The Solace Extra WordPress plugin before 1.7.2 does not perform any au ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-79538 (metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code E ...)
TODO: check
CVE-2026-79537 (metatool-ai MetaMCP through 2.4.22 contains an insecure direct object ...)
@@ -117,47 +117,47 @@ CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level authori
CVE-2026-78229 (Image Scanner Driver for Linux contains an OS command injection vulner ...)
TODO: check
CVE-2026-76738 (A buffer overflow vulnerability exists in the API endpoint of HPE Netw ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76737 (An authenticated path traversal vulnerability exists in the command li ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76736 (A buffer overflow vulnerability exists in the underlying operating sys ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76735 (A sensitive information disclosure vulnerability exists in the underly ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76734 (A memory corruption vulnerability in the affected interface of HPE Net ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76733 (A denial-of-service vulnerability exists in the API endpoint of HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76732 (A local privilege-escalation vulnerability has been discovered in the ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76731 (An authentication bypass vulnerability in the captive portal of HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76730 (An authentication bypass vulnerability exists in the PAPI protocol of ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76729 (A format string vulnerability in the API endpoint of HPE Networking In ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76728 (A vulnerability in the API endpoint of HPE Networking Instant ON APs c ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76727 (Command injection vulnerabilities exist in the affected interface of H ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76726 (An authentication bypass vulnerability in the API endpoint of HPE Netw ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76725 (A vulnerability has been identified in a management protocol of HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76724 (A command injection vulnerability exists in CLI of the affected HPE Ne ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76723 (Buffer overflow vulnerabilities exist in the affected interface of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76722 (Uncontrolled Format string vulnerabilities exist in the affected inter ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-76721 (Buffer overflow vulnerability exists in the affected interface of HPE ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-75873 (The Zella Theme WordPress theme before 2.6.3 does not perform any capa ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75824 (The User Frontend WordPress plugin before 4.3.12 does not check wheth ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-75823 (The User Frontend WordPress plugin before 4.3.12 does not prevent tam ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-74225 (U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp ...)
TODO: check
CVE-2026-74222 (U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in t ...)
@@ -209,15 +209,15 @@ CVE-2026-51936 (Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcip
CVE-2026-39117 (An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-serve ...)
TODO: check
CVE-2026-18145 (A stack-based buffer overflow vulnerability in the spamBlocker (spamd) ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-18105 (An uncontrolled resource consumption vulnerability in Fireware OS's di ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-15278
REJECTED
CVE-2026-13224 (A path traversal vulnerability in the Fireware OS WebUI management age ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-13046 (A deserialization of untrusted data vulnerability in WatchGuard Firewa ...)
- TODO: check
+ NOT-FOR-US: WatchGuard
CVE-2026-11415
REJECTED
CVE-2026-103111 (PCRE2 before 10.49, when there is an attacker-controlled regular expre ...)
@@ -261,13 +261,13 @@ CVE-2026-103051 (Improper neutralization of input during web page generation ('c
CVE-2026-103050 (Improper neutralization of input during web page generation ('cross-si ...)
TODO: check
CVE-2026-103049 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103048 (URL redirection to untrusted site ('open redirect') vulnerability in T ...)
TODO: check
CVE-2026-103047 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103046 (Improper neutralization of input during web page generation ('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103045 (Improper neutralization of input during web page generation ('cross-si ...)
TODO: check
CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in The Wikimed ...)
@@ -289,17 +289,17 @@ CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python envir
CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
TODO: check
CVE-2026-102913 (A security flaw has been discovered in SourceCodester Car Driving Scho ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-102912 (A vulnerability was identified in SourceCodester Online Leave Manageme ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-102911 (A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is ...)
TODO: check
CVE-2026-102910 (A security flaw has been discovered in SourceCodester Online Reviewer ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-102909 (A vulnerability was identified in SourceCodester Online Reviewer Manag ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-102908 (A vulnerability was determined in SourceCodester Online Reviewer Manag ...)
- TODO: check
+ NOT-FOR-US: SourceCodester
CVE-2026-102906 (A vulnerability was identified in 0xshariq github-mcp-server up to 52e ...)
TODO: check
CVE-2026-102904 (JupyterLab is an extensible environment for interactive and reproducib ...)
@@ -311,7 +311,7 @@ CVE-2026-102878 (mcp-chrome-bridge through 1.0.31 contains an origin validation
CVE-2026-102877 (Fider before 0.38.0 contains a server-side request forgery vulnerabili ...)
TODO: check
CVE-2026-102876 (SurrealDB before 3.3.0 contains an authorization bypass in HTTP sessio ...)
- TODO: check
+ NOT-FOR-US: SurrealDB
CVE-2026-102875 (VLC media player before 3.0.24 contains a path traversal vulnerability ...)
TODO: check
CVE-2026-102874 (A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the ...)
@@ -367,7 +367,7 @@ CVE-2026-100292 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, a
CVE-2026-100291 (In Anjvision YSSD\u2011RTMP\u2011H5 firmware version 3.3.2.4, several ...)
TODO: check
CVE-2026-100143 (The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2024-31027 (Cross Site Scripting vulnerability in Greek Universities Network (GUne ...)
TODO: check
CVE-2024-31026 (An issue in Greek Universities Network (GUnet) Open eClass Platform v. ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf69b610b0343a90230c16f4a6cc5ff66239e2f5
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf69b610b0343a90230c16f4a6cc5ff66239e2f5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/676c0a42/attachment.htm>
More information about the debian-security-tracker-commits
mailing list