From 6768df1049a63d43db62c89a739d52fe0313e46d Mon Sep 17 00:00:00 2001 From: "Cheng-Chen, Chen" Date: Thu, 15 Oct 2026 10:43:30 +0800 Subject: [PATCH] chore(security): track newly reported Ubuntu SASL finding --- server/security/vendor-pending.json | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 6772519143..e4e076534b 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,7 +1,7 @@ { "schemaVersion": 1, "release": "v1.6.535", - "generatedAt": "2026-10-14T00:00:00Z", + "generatedAt": "2026-10-15T02:44:00Z", "policy": { "allowedSeverities": [ "LOW", @@ -26,6 +26,20 @@ { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } ] }, + { + "vulnerabilityId": "CVE-2026-107161", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Needs evaluation", + "verifiedAt": "2026-10-15T02:44:00Z", + "source": "https://ubuntu.com/security/CVE-2026-107161", + "reviewAfter": "2026-10-20", + "severityBasis": "Ubuntu priority Medium and the scanner's vendor severity; upstream CVSS v3 7.5 High is not a fix or a not-affected decision.", + "packages": [ + { "name": "libsasl2-2", "installedVersion": "2.1.28+dfsg1-9ubuntu3" }, + { "name": "libsasl2-modules-db", "installedVersion": "2.1.28+dfsg1-9ubuntu3" } + ] + }, { "vulnerabilityId": "CVE-2026-85091", "severity": "MEDIUM",