[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 30 20:16:12 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
05c04b63 by security tracker role at 2026-09-30T19:16:05+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,259 +1,259 @@
CVE-2026-97347 (The Post Views Stats Counter plugin for WordPress is vulnerable to Sto ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97302 (Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97301 (Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97299 (Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97298 (Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97293 (Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97292 (Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97291 (Contributor PHP Object Injection in Schema & Structured Data for WP & ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97290 (Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Light ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97289 (Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97288 (Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97287 (Contributor SQL Injection in Event Tickets <= 5.29.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97286 (Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97285 (Contributor Broken Access Control in The Events Calendar <= 6.17.5 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97282 (Unauthenticated Insecure Direct Object References (IDOR) in Review Sch ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97279 (Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97274 (Unauthenticated Bypass Vulnerability in OAuth Single Sign On \u2013 SS ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97272 (Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Mana ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97271 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97270 (Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97267 (Subscriber Broken Access Control in Prevent files / folders access <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97266 (Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolk ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97265 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97262 (Contributor Cross Site Scripting (XSS) in Visual Composer Website Buil ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97261 (Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97259 (Authorization Bypass Through User-Controlled Key vulnerability in WP H ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97256 (Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97253 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97250 (Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97249 (Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97248 (Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97247 (Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97246 (Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97245 (Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97244 (Contributor Path Traversal in Creator LMS <= 1.2.19 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97243 (Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97242 (Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97241 (Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97240 (Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97239 (Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97238 (Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97237 (Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97236 (Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97235 (Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97197 (Unauthenticated Broken Access Control in WordPress Backup & Migration ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97150 (When converting baserCMS4-style addons to baserCMS5-style ones, BcAddo ...)
TODO: check
CVE-2026-97079 (Subscriber Insecure Direct Object References (IDOR) in Webba Booking < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97078 (Unauthenticated Insecure Direct Object References (IDOR) in Client Inv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97077 (Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97074 (Subscriber Insecure Direct Object References (IDOR) in Newsletters, Em ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97067 (Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97066 (Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-97065 (Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96838 (Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96837 (Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96836 (Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versio ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96835 (Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96834 (Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96833 (Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96832 (Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96831 (Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96830 (Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96829 (Contributor Cross Site Scripting (XSS) in The Plus Addons for Elemento ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96828 (Administrator SQL Injection in Category Discount Woocommerce <= 5.18 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96827 (Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96825 (Subscriber Bypass Vulnerability in All In One WP Security & Firewall < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96824 (Editor Arbitrary File Deletion in Template Kit \u2013 Import <= 1.0.16 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96823 (Unauthenticated Arbitrary Content Deletion in Customer Reviews for Woo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96822 (Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96821 (Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96820 (Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96819 (Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96818 (Unauthenticated Broken Access Control in WP Express Checkout (Accept P ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96817 (Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96816 (Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96815 (Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96814 (Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Tabl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96450 (Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 version ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96352 (Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Se ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96351 (Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96350 (Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96349 (Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96348 (Unauthenticated Broken Access Control in Bookly <= 28.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96347 (Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96346 (Author SQL Injection in WP ERP <= 1.17.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96345 (Administrator SQL Injection in Estatik <= 4.3.5 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96344 (Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96343 (Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96342 (Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappnin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an oversized allo ...)
TODO: check
CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-95531 (Subscriber PHP Object Injection in Conversational Forms for ChatBot <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94683 (Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94681 (Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94678 (Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94677 (Shop manager PHP Object Injection in Kadence WooCommerce Email Designe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94674 (Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94673 (Unauthenticated Insecure Direct Object References (IDOR) in Simply Sch ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94672 (Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94545 (Satori is a library to convert HTML and CSS to SVG. Starting in versio ...)
TODO: check
CVE-2026-94499 (Subscriber Broken Access Control in FormGent <= 1.12.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94389 (Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newslet ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94178 (Subscriber Privilege Escalation in Import and export users and custome ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94177 (Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94173 (Contributor Insecure Direct Object References (IDOR) in Business Direc ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94171 (Unauthenticated Cross Site Scripting (XSS) in CURCY <= 2.2.16 versions ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94123 (Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94122 (Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94121 (Contributor PHP Object Injection in 10Web Booster \u2013 Website speed ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94120 (Unauthenticated Broken Access Control in GravityExport Lite for Gravit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94115 (Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94082 (Author SQL Injection in Quiz Cat <= 3.1.1 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94081 (Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Log ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94078 (Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94077 (Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94076 (Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-94074 (Unauthenticated Broken Access Control in Simply Schedule Appointments ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93908 (The Real Estate Manager \u2013 Property Listing and Agent Management p ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93903 (LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal r ...)
TODO: check
CVE-2026-93771 (Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93770 (Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93651 (Author PHP Object Injection in Minimum and Maximum Quantity for WooCom ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93624 (Shop manager PHP Object Injection in Music Player for WooCommerce <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93621 (Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93547 (A missing authorization check in the Vaadin Spreadsheet component allo ...)
TODO: check
CVE-2026-93514 (Unauthenticated Cross Site Scripting (XSS) in Notification for Telegra ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93512 (Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-93464 (Stored Cross-Site Scripting via custom content descriptions vulnerabil ...)
TODO: check
CVE-2026-93463 (Cross-Site Scripting via Script Validation Bypass exists in baserCMS. ...)
@@ -279,7 +279,7 @@ CVE-2026-92868 (An improper certificate validation vulnerability exists in Pgpoo
CVE-2026-92867 (An out-of-bounds write vulnerability exists in Pgpool-II , which may a ...)
TODO: check
CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin for WordPr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using the WS ...)
TODO: check
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
@@ -289,7 +289,7 @@ CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-
CVE-2026-88920 (An authentication bypass in the DOM security processor in Apache WSS4J ...)
TODO: check
CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain relative or ...)
TODO: check
CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
@@ -303,49 +303,49 @@ CVE-2026-82307 (Improper neutralization of special elements used in an SQL comma
CVE-2026-79625 (Affected products do not properly synchronize access to their monitori ...)
TODO: check
CVE-2026-76992 (The CODESYS Gateway Client allocates memory based on a size field in a ...)
- TODO: check
+ NOT-FOR-US: CODESYS
CVE-2026-76570 (Joomla Extension - joomcode.com - Unauthenticated SQL injection in rea ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-76504 (A vulnerability in the API session-based authentication management of ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2026-75969 (Missing authentication for critical function vulnerability for all PTZ ...)
TODO: check
CVE-2026-75098 (The Product Designer App plugin for WordPress is vulnerable to Directo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-74865 (sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthenticatio ...)
TODO: check
CVE-2026-74864 (sogo_yhn configures SOGo with a parameter that forces the request with ...)
TODO: check
CVE-2026-6806 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6173 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6172 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6171 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-6170 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-62308 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
TODO: check
CVE-2026-62146 (A trust-boundary flaw in CRI-O's sandbox state persistence allows atta ...)
TODO: check
CVE-2026-62097 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62085 (Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62084 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62083 (Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62081 (Contributor Insecure Direct Object References (IDOR) in Flexible PDF C ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62080 (Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor < ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62079 (Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62078 (Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-55494 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
TODO: check
CVE-2026-55224 (MineAdmin is a ready-to-use backend management system suitable for qui ...)
@@ -597,9 +597,9 @@ CVE-2026-47097 (AJA HELO Plus firmware before 2.1.7 contains an information disc
CVE-2026-46711 (Soft Machine is a Virtual Machine\u2013based agentic development envir ...)
TODO: check
CVE-2026-27371 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 vers ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27085 (Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 ver ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname argument ...)
TODO: check
CVE-2026-18783 (Missing authentication for critical function vulnerability in Trex Dig ...)
@@ -607,21 +607,21 @@ CVE-2026-18783 (Missing authentication for critical function vulnerability in Tr
CVE-2026-18782 (Improper neutralization of special elements used in an SQL command ('S ...)
TODO: check
CVE-2026-16596 (The WP Directory Kit plugin for WordPress is vulnerable to generic SQL ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-14876 (The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-13720 (An Editor can set file-provisioning metadata (the grafana.app/managedB ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-13719 (An authenticated user can list alert rules stored in folders they are ...)
- TODO: check
+ NOT-FOR-US: Grafana
CVE-2026-11895 (The HT Mega Addons for Elementor \u2013 Elementor Widgets & Template B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-10764 (Information disclosure in BVMS 4.5 up to 12.3 including allows man-in- ...)
TODO: check
CVE-2026-10739 (Cato Networks SDP Client for Windows before 6.12.6 allows a local user ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an arbitrary fi ...)
- TODO: check
+ NOT-FOR-US: Cato
CVE-2026-103500 (An attacker could cause a heap buffer overflow by getting a user to op ...)
TODO: check
CVE-2026-103476 (yii2-starter-kit through 4.2.0 fails to validate article publication s ...)
@@ -727,7 +727,7 @@ CVE-2026-102984 (Astro is a web framework for content-driven websites. Prior to
CVE-2026-102983 (Astro is a web framework for content-driven websites. From 5.2.0 until ...)
TODO: check
CVE-2026-102717 (MQTT WebSocket setter ABI mismatch may disclose memory or cause a cras ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102588 (A flaw was found in Moodle. The XML grade import feature lacks proper ...)
TODO: check
CVE-2026-102587 (A flaw was found in Moodle. User list filters do not properly enforce ...)
@@ -777,103 +777,103 @@ CVE-2026-102455 (EasyFlow .NET developed by Digiwin has a Insecure Deserializati
CVE-2026-102454 (EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulner ...)
TODO: check
CVE-2026-102427 (Joomla Extension - ordasoft.com - Unauthenticated Remote Code Executio ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102399 (Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102398 (Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102397 (Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102396 (Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsyst ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102395 (Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102392 (Shop manager PHP Object Injection in Extra Product Options For WooComm ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102391 (Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5. ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102386 (Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102385 (Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102384 (Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 ve ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102377 (Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 v ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102376 (Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-102375 (Subscriber Broken Access Control in Optimole <= 4.2.14 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-101295 (Path traversal / arbitrary file write in oc-mirror's operator catalog ...)
TODO: check
CVE-2026-100513 (Contributor Cross Site Scripting (XSS) in CF7 Views – Complete E ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100512 (Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100510 (Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100508 (Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100507 (Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Pe ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-100280 (In JetBrains YouTrack before 2026.2.19197 creating a project from an u ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100279 (In JetBrains YouTrack before 2026.2.19197 changing an integration URL ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100278 (In JetBrains YouTrack before 2026.2.19197 users with restricted permis ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100277 (In JetBrains YouTrack before 2026.2.19197 account takeover was possibl ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100276 (In JetBrains YouTrack before 2026.2.19197 guest users could remove a w ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100275 (In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow e ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100274 (In JetBrains YouTrack before 2026.2.19197 project Admin could trigger ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100273 (In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100272 (In JetBrains YouTrack before 2026.2.19197 missing authorisation in the ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100271 (In JetBrains YouTrack before 2026.2.19197 missing authorisation on sev ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100270 (In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permiss ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100269 (In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorize ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100268 (In JetBrains YouTrack before 2026.2.19197 project administrators could ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100267 (In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible vi ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100266 (In JetBrains Hub before 2026.2.52366 missing authorisation allowed aut ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100265 (In JetBrains Rider before 2026.2.1 aI Assistant could auto-update thir ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100264 (In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentia ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100263 (In JetBrains YouTrack before 2026.2.18991 stored HTML injection via th ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100262 (In JetBrains YouTrack before 2026.2.18991 missing authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100261 (In JetBrains YouTrack before 2026.2.18991 changing article visibility ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100260 (In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100259 (In JetBrains YouTrack before 2026.2.18991 improper access control on G ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100258 (In JetBrains YouTrack before 2026.2.18991 missing authorisation allowe ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100257 (In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML inject ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100256 (In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search s ...)
TODO: check
CVE-2026-100255 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrat ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100254 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticat ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2026-100253 (In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox esc ...)
- TODO: check
+ NOT-FOR-US: JetBrains
CVE-2025-14564 (The Viable URL Media Uploader plugin for WordPress is vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or call t ...)
- python3.15 <unfixed>
- python3.14 <unfixed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05c04b633b395d43aa5fb3e1b864aaf874cbb576
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/05c04b633b395d43aa5fb3e1b864aaf874cbb576
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/c5bf805a/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list