[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Sep 30 21:59:54 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
11d7f8e0 by Salvatore Bonaccorso at 2026-09-30T22:59:30+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -323,13 +323,13 @@ CVE-2026-76570 (Joomla Extension - joomcode.com - Unauthenticated SQL injection
 CVE-2026-76504 (A vulnerability in the API session-based authentication management of  ...)
 	NOT-FOR-US: Cisco
 CVE-2026-75969 (Missing authentication for critical function vulnerability for all PTZ ...)
-	TODO: check
+	NOT-FOR-US: PTZOptics cameras
 CVE-2026-75098 (The Product Designer App plugin for WordPress is vulnerable to Directo ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-74865 (sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthenticatio ...)
-	TODO: check
+	NOT-FOR-US: sogo_yhn
 CVE-2026-74864 (sogo_yhn configures SOGo with a parameter that forces the request with ...)
-	TODO: check
+	NOT-FOR-US: sogo_yhn
 CVE-2026-6806 (The Motors \u2013 Car Dealership & Classified Listings Plugin plugin f ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-6173 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
@@ -341,7 +341,7 @@ CVE-2026-6171 (The Bold Page Builder plugin for WordPress is vulnerable to Store
 CVE-2026-6170 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-62308 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
-	TODO: check
+	NOT-FOR-US: Tugtainer
 CVE-2026-62146 (A trust-boundary flaw in CRI-O's sandbox state persistence allows atta ...)
 	TODO: check
 CVE-2026-62097 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
@@ -361,23 +361,23 @@ CVE-2026-62079 (Contributor Cross Site Scripting (XSS) in Qi Addons For Elemento
 CVE-2026-62078 (Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-55494 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
-	TODO: check
+	NOT-FOR-US: Tugtainer
 CVE-2026-55224 (MineAdmin is a ready-to-use backend management system suitable for qui ...)
-	TODO: check
+	NOT-FOR-US: MineAdmin
 CVE-2026-55181 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
-	TODO: check
+	NOT-FOR-US: Tugtainer
 CVE-2026-55177 (CloudTAK is a browser-based Common Operating Picture and situational a ...)
-	TODO: check
+	NOT-FOR-US: CloudTAK
 CVE-2026-55176 (Soft Machine is a Virtual Machine\u2013based agentic development envir ...)
-	TODO: check
+	NOT-FOR-US: Soft Machine
 CVE-2026-55174 (UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engi ...)
-	TODO: check
+	NOT-FOR-US: UltrafastSecp256k1
 CVE-2026-55107 (Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter ins ...)
-	TODO: check
+	NOT-FOR-US: Kobako
 CVE-2026-55094 (Taskcluster is the task execution framework that supports Mozilla's co ...)
-	TODO: check
+	NOT-FOR-US: Taskcluster
 CVE-2026-53605 (Reachy Mini ISO for Wireless contains the necessary files to build a c ...)
-	TODO: check
+	NOT-FOR-US: Reachy
 CVE-2026-47604 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
 	TODO: check
 CVE-2026-47603 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -607,9 +607,9 @@ CVE-2026-47491 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
 CVE-2026-47489 (NVIDIA GPU Display Driver for Linux contains a vulnerability in the ke ...)
 	TODO: check
 CVE-2026-47097 (AJA HELO Plus firmware before 2.1.7 contains an information disclosure ...)
-	TODO: check
+	NOT-FOR-US: AJA HELO Plus firmware
 CVE-2026-46711 (Soft Machine is a Virtual Machine\u2013based agentic development envir ...)
-	TODO: check
+	NOT-FOR-US: Soft Machine
 CVE-2026-27371 (Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 vers ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-27085 (Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 ver ...)
@@ -627,9 +627,9 @@ CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname arg
 	NOTE: https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062 (3.13 branch)
 	NOTE: https://github.com/python/cpython/pull/158516 (3.11)
 CVE-2026-18783 (Missing authentication for critical function vulnerability in Trex Dig ...)
-	TODO: check
+	NOT-FOR-US: Trex MES
 CVE-2026-18782 (Improper neutralization of special elements used in an SQL command ('S ...)
-	TODO: check
+	NOT-FOR-US: Trex MES
 CVE-2026-16596 (The WP Directory Kit plugin for WordPress is vulnerable to generic SQL ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-14876 (The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross- ...)
@@ -641,7 +641,7 @@ CVE-2026-13719 (An authenticated user can list alert rules stored in folders the
 CVE-2026-11895 (The HT Mega Addons for Elementor \u2013 Elementor Widgets & Template B ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-10764 (Information disclosure in BVMS 4.5 up to 12.3 including allows man-in- ...)
-	TODO: check
+	NOT-FOR-US: BVMS
 CVE-2026-10739 (Cato Networks SDP Client for Windows before 6.12.6 allows a local user ...)
 	NOT-FOR-US: Cato
 CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an arbitrary fi ...)
@@ -649,19 +649,19 @@ CVE-2026-10726 (Cato Windows SDP Client before version 6.12.6 contains an arbitr
 CVE-2026-103500 (An attacker could cause a heap buffer overflow by getting a user to op ...)
 	TODO: check
 CVE-2026-103476 (yii2-starter-kit through 4.2.0 fails to validate article publication s ...)
-	TODO: check
+	NOT-FOR-US: yii2-starter-kit
 CVE-2026-103475 (yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules t ...)
-	TODO: check
+	NOT-FOR-US: yii2-starter-kit
 CVE-2026-103474 (yii2-starter-kit through 4.2.0 fails to validate file types in the bac ...)
-	TODO: check
+	NOT-FOR-US: yii2-starter-kit
 CVE-2026-103473 (Deno versions 2.7.0 through 2.9.7 on Windows contain a command injecti ...)
-	TODO: check
+	NOT-FOR-US: Deno
 CVE-2026-103472 (restbed through 5.0.0 accepts WebSocket frames with declared payload l ...)
-	TODO: check
+	NOT-FOR-US: restbed
 CVE-2026-103471 (restbed through 5.0.0 buffers HTTP request headers without enforcing a ...)
-	TODO: check
+	NOT-FOR-US: restbed
 CVE-2026-103470 (In Internet2 Grouper before 7.5.1 (in some configurations), a user who ...)
-	TODO: check
+	NOT-FOR-US: Internet2 Grouper
 CVE-2026-103446 (Authorization bypass through User-Controlled key vulnerability in The  ...)
 	TODO: check
 CVE-2026-103445 (Improper neutralization of Script-Related HTML tags in a web page (bas ...)
@@ -691,13 +691,13 @@ CVE-2026-103432 (apcupsd through 3.14.14 has an sscanf stack-based buffer overfl
 CVE-2026-103399 (A flaw was found in SoupServer (libsoup). When an HTTP/1.x client send ...)
 	TODO: check
 CVE-2026-103398 (OpenSave through 2.4.0 fails to properly validate save paths supplied  ...)
-	TODO: check
+	NOT-FOR-US: OpenSave
 CVE-2026-103397 (OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN  ...)
-	TODO: check
+	NOT-FOR-US: OpenSave
 CVE-2026-103396 (bbs-go through 4.4.6 contains a permission bypass vulnerability in the ...)
-	TODO: check
+	NOT-FOR-US: bbs-go
 CVE-2026-103395 (LightLLM through 1.2.0 visual_only deployments expose an unauthenticat ...)
-	TODO: check
+	NOT-FOR-US: LightLLM
 CVE-2026-103389 (MISP contains a stored cross-site scripting (XSS) vulnerability in the ...)
 	TODO: check
 CVE-2026-103388 (MISP renders the source field of a Galaxy Cluster as a clickable hyper ...)
@@ -705,9 +705,9 @@ CVE-2026-103388 (MISP renders the source field of a Galaxy Cluster as a clickabl
 CVE-2026-103321 (MISP contains a stored cross-site script (XSS) vulnerability in the ev ...)
 	TODO: check
 CVE-2026-103270 (LightLLM through 1.2.0 mounts reinforcement learning control routes on ...)
-	TODO: check
+	NOT-FOR-US: LightLLM
 CVE-2026-103243 (LightLLM through 1.2.0 fails to validate image_url and audio_url param ...)
-	TODO: check
+	NOT-FOR-US: LightLLM
 CVE-2026-103242 (A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATU ...)
 	TODO: check
 CVE-2026-103241 (A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerab ...)
@@ -719,15 +719,15 @@ CVE-2026-103237 (MISP contains an improper input validation vulnerability in its
 CVE-2026-103235 (MISP contains a mass assignment vulnerability in the event delegation  ...)
 	TODO: check
 CVE-2026-103233 (A security vulnerability has been detected in AdithyaYelloju Restauran ...)
-	TODO: check
+	NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
 CVE-2026-103232 (A weakness has been identified in AdithyaYelloju Restaurant-Management ...)
-	TODO: check
+	NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
 CVE-2026-103231 (A vulnerability was identified in AdithyaYelloju Restaurant-Management ...)
-	TODO: check
+	NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
 CVE-2026-103230 (A vulnerability was determined in AdithyaYelloju Restaurant-Management ...)
-	TODO: check
+	NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
 CVE-2026-103229 (A vulnerability was found in AdithyaYelloju Restaurant-Management-Syst ...)
-	TODO: check
+	NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
 CVE-2026-103227 (A weakness has been identified in GPAC up to 26.07.0. Affected by this ...)
 	TODO: check
 CVE-2026-103226 (A vulnerability was identified in Artifex Ghostscript up to 10.09.0. A ...)
@@ -739,21 +739,21 @@ CVE-2026-103222 (A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. T
 CVE-2026-103118 (A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected  ...)
 	TODO: check
 CVE-2026-103117 (A security vulnerability has been detected in OS4ED openSIS-Classic up ...)
-	TODO: check
+	NOT-FOR-US: OS4ED openSIS
 CVE-2026-103116 (A weakness has been identified in OS4ED openSIS-Classic up to 9.3. Thi ...)
-	TODO: check
+	NOT-FOR-US: OS4ED openSIS
 CVE-2026-103115 (A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3 ...)
-	TODO: check
+	NOT-FOR-US: OS4ED openSIS
 CVE-2026-103114 (A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The ...)
-	TODO: check
+	NOT-FOR-US: OS4ED openSIS
 CVE-2026-103113 (A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The ...)
-	TODO: check
+	NOT-FOR-US: OS4ED openSIS
 CVE-2026-103012 (Claude Code selected an API key stored by Claude Code, for example fro ...)
-	TODO: check
+	NOT-FOR-US: Claude Code
 CVE-2026-102984 (Astro is a web framework for content-driven websites. Prior to 11.1.3, ...)
-	TODO: check
+	NOT-FOR-US: Astro
 CVE-2026-102983 (Astro is a web framework for content-driven websites. From 5.2.0 until ...)
-	TODO: check
+	NOT-FOR-US: Astro
 CVE-2026-102717 (MQTT WebSocket setter ABI mismatch may disclose memory or cause a cras ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-102588 (A flaw was found in Moodle. The XML grade import feature lacks proper  ...)
@@ -1096,9 +1096,9 @@ CVE-2026-74220 (U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read
 	NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/aa207cf3a6d68f39d64cd29057a4fb63943e9078 (v2019.10-rc4)
 	NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a (v2026.10-rc5)
 CVE-2026-72510 (The "supplier_no" parameter used in the business allocation search fea ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-72507 (The "reportType" parameter in the product summary report feature withi ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-71974 (U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerabilit ...)
 	TODO: check
 CVE-2026-71973 (U-Boot before 2026.10-rc4 contains an integer overflow vulnerability i ...)
@@ -1108,35 +1108,35 @@ CVE-2026-71972 (U-Boot through 2026.10-rc5 contains an out-of-bounds write vulne
 CVE-2026-71971 (U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an ou ...)
 	TODO: check
 CVE-2026-71379 (The file export endpoint allows any unauthenticated attacker to export ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-71302 (The application accepts user-supplied session identifiers and does not ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-71189 (An attacker can construct a request that, if issued by another applica ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-70356 (The TMS file upload endpoint fails to enforce server-side file type re ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-69662 (The application uses unsafe functions that allow execution of inline s ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-68954 (The "pattern" parameter used in search function in the home page of th ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-68068 (The "screenID" parameter in the electronic transaction queue viewer fe ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-67993 (basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f co ...)
-	TODO: check
+	NOT-FOR-US: basecamp/upright
 CVE-2026-67987 (crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 cont ...)
-	TODO: check
+	NOT-FOR-US: crmne/ruby_llm
 CVE-2026-63713 (The "search" parameter in the view audit logs feature within the utili ...)
-	TODO: check
+	NOT-FOR-US: Toptech Systems
 CVE-2026-61519 (Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulner ...)
-	TODO: check
+	NOT-FOR-US: Liberu CRM
 CVE-2026-53989 (Dockhand before 1.0.36 contains an open redirect vulnerability in the  ...)
-	TODO: check
+	NOT-FOR-US: Dockhand
 CVE-2026-53988 (Dockhand before 1.0.40 contains an authentication bypass vulnerability ...)
-	TODO: check
+	NOT-FOR-US: Dockhand
 CVE-2026-51936 (Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_ex ...)
-	TODO: check
+	NOT-FOR-US: Zetetic
 CVE-2026-39117 (An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-serve ...)
-	TODO: check
+	NOT-FOR-US: AltumCode 66Uptime
 CVE-2026-18145 (A stack-based buffer overflow vulnerability in the spamBlocker (spamd) ...)
 	NOT-FOR-US: WatchGuard
 CVE-2026-18105 (An uncontrolled resource consumption vulnerability in Fireware OS's di ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/11d7f8e08eb05b58bb0c143a3797578b2da65682

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/11d7f8e08eb05b58bb0c143a3797578b2da65682
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/fb62f0ae/attachment-0001.htm>

More information about the debian-security-tracker-commits mailing list