[Git][security-tracker-team/security-tracker][master] Process some NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6e3cfa58 by Salvatore Bonaccorso at 2026-09-30T10:23:55+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -7,9 +7,9 @@ CVE-2026-96886 (The Course Booking System WordPress plugin before 7.0.9 does not
 CVE-2026-96649 (The Frontend Post Submission Manager Lite \u2013 Frontend Posting Word ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96587 (The Viidure Android application embeds permanent, plaintext cloud stor ...)
-	TODO: check
+	NOT-FOR-US: Viidure
 CVE-2026-96274 (In Baicells Nova 430H, an unauthenticated device within radio range ca ...)
-	TODO: check
+	NOT-FOR-US: Baicells Nova 430H
 CVE-2026-94953 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
 	NOT-FOR-US: TOTOLINK
 CVE-2026-94952 (A stack-based buffer overflow vulnerability exists in the web manageme ...)
@@ -19,7 +19,7 @@ CVE-2026-94297 (The Media Library Organizer  WordPress plugin before 2.1.4 does
 CVE-2026-94274 (The YayReviews  WordPress plugin before 1.4.1 does not restrict access ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-94204 (The central cloud storage backend for the entire dashcam platform is m ...)
-	TODO: check
+	NOT-FOR-US: Viidure
 CVE-2026-93853 (Unverified ownership in Barman snapshot backup deletion allows a princ ...)
 	TODO: check
 CVE-2026-93580 (The InPost PL WordPress plugin before 1.9.8 does not verify the authen ...)
@@ -31,7 +31,7 @@ CVE-2026-92424 (The Content Egg  WordPress plugin before 11.9.0 does not verify
 CVE-2026-91832 (The WP Mobile Menu  WordPress plugin before 2.9 does not correctly ver ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-91191 (The device's update mechanism includes conditions that allow unauthori ...)
-	TODO: check
+	NOT-FOR-US: Lantronix
 CVE-2026-91072 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confin ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-91051 (The EWWW Image Optimizer WordPress plugin before 8.8.0 does not preven ...)
@@ -83,7 +83,7 @@ CVE-2026-85415 (The Audio Player Block  WordPress plugin before 1.6.3 does not v
 CVE-2026-85001 (The EmbedPress  WordPress plugin before 4.6.7 does not sanitise and es ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-84409 (The device's update mechanism retrieves metadata for software updates  ...)
-	TODO: check
+	NOT-FOR-US: Lantronix
 CVE-2026-83560 (The New User Approve WordPress plugin before 3.2.10 does not properly  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-82127 (The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 ...)
@@ -95,21 +95,21 @@ CVE-2026-81841 (Pausing a shared (public) dashboard did not revoke its access to
 CVE-2026-81433 (A stack-based buffer overflow vulnerability in WatchGuard Fireware OS' ...)
 	NOT-FOR-US: WatchGuard
 CVE-2026-81310 (Image Scanner Driver for Linux contains a link following vulnerability ...)
-	TODO: check
+	NOT-FOR-US: Ricoh
 CVE-2026-80333 (The Solace Extra WordPress plugin before 1.7.2 does not perform any au ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-79538 (metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code E ...)
-	TODO: check
+	NOT-FOR-US: metatool-ai MetaMCP
 CVE-2026-79537 (metatool-ai MetaMCP through 2.4.22 contains an insecure direct object  ...)
-	TODO: check
+	NOT-FOR-US: metatool-ai MetaMCP
 CVE-2026-79536 (bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulner ...)
-	TODO: check
+	NOT-FOR-US: bytebase dbhub
 CVE-2026-79535 (mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The ...)
-	TODO: check
+	NOT-FOR-US: mbailey VoiceMode
 CVE-2026-79534 (mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Tra ...)
-	TODO: check
+	NOT-FOR-US: mark3labs mcp-filesystem-server
 CVE-2026-79417 (Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMo ...)
-	TODO: check
+	NOT-FOR-US: Argotronic eGbR ArgusMonitor
 CVE-2026-79403 (An issue in Kilo Code before v7.4.1 allows a local attacker to execute ...)
 	TODO: check
 CVE-2026-79348 (KitchenAsty through 0.3.0 contains a broken object level authorization ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e3cfa58dc9c9e1a9b4864bbd21d761ff26338d1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e3cfa58dc9c9e1a9b4864bbd21d761ff26338d1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/d0dd94eb/attachment.htm>