From 28f3e15738a77aef604904e572216c157ad85e5f Mon Sep 17 00:00:00 2001
From: felhom security watch <monitoring@felhom.eu>
Date: Fri, 30 Oct 2026 03:44:05 +0000
Subject: [PATCH] security-watch: memory of 2026-10-30 (R-1303). Docs only.

---
 documentation/security-watch/state.json | 99 +++++++++++++++++--------
 1 file changed, 68 insertions(+), 31 deletions(-)

diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json
index 5b7064f8..6b41027f 100644
--- a/documentation/security-watch/state.json
+++ b/documentation/security-watch/state.json
@@ -38,6 +38,12 @@
    "program": "cloudflare/cloudflared 2026.10.4 (controller infra)",
    "summary": "- 2026-10-26 VULN-183456: Bump github.com/go-chi/chi/v5 to v5.5.0"
   },
+  "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.6:VULN-184686": {
+   "first": "2026-10-30",
+   "last_mailed": "2026-10-30",
+   "program": "cloudflare/cloudflared 2026.10.4 (controller infra)",
+   "summary": "- 2026-10-28 VULN-184686: Bump github.com/go-jose/go-jose/v4 to v4.1.6"
+  },
   "codewithcj/sparkyfitness_server|CVE-2026-111497": {
    "first": "2026-10-28",
    "last_mailed": "2026-10-28",
@@ -357,6 +363,12 @@
    "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)",
    "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322"
   },
+  "dooplex:ghcr.io/paperless-ngx/paperless-ngx|release:paperless-ngx/paperless-ngx@v3.4.0": {
+   "first": "2026-10-30",
+   "last_mailed": "2026-10-30",
+   "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)",
+   "summary": "Chore: bump some frontend deps for security fixes  @shamoon  ( #14581 )"
+  },
   "dooplex:gitea/gitea|GHSA-25gq-j9jx-43pg": {
    "first": "2026-10-28",
    "last_mailed": "2026-10-28",
@@ -1511,6 +1523,12 @@
    "silent": "first read after the seed",
    "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft"
   },
+  "ghcr.io/lukegus/termix|release:Termix-SSH/Termix@v26.10.6": {
+   "first": "2026-10-30",
+   "last_mailed": "2026-10-30",
+   "program": "ghcr.io/lukegus/termix 26.10.5 (termix)",
+   "summary": "0 for a security fix"
+  },
   "ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": {
    "first": "2026-10-28",
    "last_mailed": "2026-10-28",
@@ -1900,6 +1918,18 @@
    "program": "n8nio/n8n 2.44.7 (n8n)",
    "summary": "Open Redirect via MCP OAuth Dynamic Client Registration"
   },
+  "privatebin/pdo|GHSA-c4gc-8mcm-hh65": {
+   "first": "2026-10-30",
+   "last_mailed": "2026-10-30",
+   "program": "privatebin/pdo 2.1.0 (privatebin)",
+   "summary": "GHSA-w873-3ghv-hmh6 fix in 2.1.0 is ineffective: USE_PROFILES discards the new ALLOWED_ATTR"
+  },
+  "privatebin/pdo|GHSA-hw9p-r7fq-8mvr": {
+   "first": "2026-10-30",
+   "last_mailed": "2026-10-30",
+   "program": "privatebin/pdo 2.1.0 (privatebin)",
+   "summary": "Unauthenticated encrypted comment replay allows persistent discussion reparenting"
+  },
   "rommapp/romm|CVE-2026-111497": {
    "first": "2026-10-28",
    "last_mailed": "2026-10-28",
@@ -1908,17 +1938,13 @@
   }
  },
  "failures": {
-  "github": {
-   "mailed": false,
-   "streak": 1
-  },
   "registry:docker.io": {
    "mailed": true,
-   "streak": 3
+   "streak": 4
   },
   "runtime": {
    "mailed": true,
-   "streak": 2
+   "streak": 3
   }
  },
  "runtime_cache": {
@@ -1960,6 +1986,17 @@
    "python": null,
    "unchecked": []
   },
+  "sha256:04a67669899e825ae87afcdf27fd28f98b554af40b05294fea8bf00fb5a6a3d7": {
+   "apk": {},
+   "brotli": null,
+   "brotlicffi": null,
+   "digest": "sha256:21f242d85a68537aa510bb8626fa6ef9c879732ad2c916ce5905ee10f1206b93",
+   "dpkg": {},
+   "env": {},
+   "node": "26.12.1",
+   "python": null,
+   "unchecked": []
+  },
   "sha256:084b3b2ab1d0ef930660727259546a241f2bdf67c9ed085d54bf1486a6887c9b": {
    "apk": {
     "brotli-libs": "1.2.1-r0"
@@ -2432,20 +2469,6 @@
    "python": null,
    "unchecked": []
   },
-  "sha256:3ac1c9ea03bafa2588dd8acdcb809857bae305e71d2d90e11d689c78076a9c01": {
-   "apk": {
-    "brotli-libs": "1.2.0-r1",
-    "python3": "3.14.8-r0"
-   },
-   "brotli": null,
-   "brotlicffi": null,
-   "digest": "sha256:93e23ba7dd20c4a00da1bdeb9adf9d622890a11caed4f5468892f48eef7b0c0c",
-   "dpkg": {},
-   "env": {},
-   "node": null,
-   "python": null,
-   "unchecked": []
-  },
   "sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
    "apk": {},
    "brotli": null,
@@ -2818,17 +2841,6 @@
    "python": null,
    "unchecked": []
   },
-  "sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af": {
-   "apk": {},
-   "brotli": null,
-   "brotlicffi": null,
-   "digest": "sha256:1cf73a2f04808e55a8bd2f5706c2aa0ebb0f71938f93deb7af79f48311cd5cb9",
-   "dpkg": {},
-   "env": {},
-   "node": null,
-   "python": null,
-   "unchecked": []
-  },
   "sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f": {
    "apk": {},
    "brotli": "1.1.0",
@@ -3095,6 +3107,17 @@
    "python": "3.13.18",
    "unchecked": []
   },
+  "sha256:8da19c7399dca900c6822a1cf30f9d2285585e2c4b457ff4095b0f4500054d3f": {
+   "apk": {},
+   "brotli": null,
+   "brotlicffi": null,
+   "digest": "sha256:1cf73a2f04808e55a8bd2f5706c2aa0ebb0f71938f93deb7af79f48311cd5cb9",
+   "dpkg": {},
+   "env": {},
+   "node": null,
+   "python": null,
+   "unchecked": []
+  },
   "sha256:92bfd78d731e254ba64f62b77b0696add6447a33642ee5feda106a26b285aa7f": {
    "apk": {
     "brotli-libs": "1.2.0-r1",
@@ -3302,6 +3325,20 @@
    "python": null,
    "unchecked": []
   },
+  "sha256:a7cfba459929f73b83c98b476a845076dc72524af80b24fcb4200684e6b1b675": {
+   "apk": {
+    "brotli-libs": "1.2.1-r0",
+    "python3": "3.14.10-r1"
+   },
+   "brotli": null,
+   "brotlicffi": null,
+   "digest": "sha256:2b69019ef0b01bcdb9fb5d6641516bd57cb73b8f98b1a34f61ab749c5ea63376",
+   "dpkg": {},
+   "env": {},
+   "node": null,
+   "python": null,
+   "unchecked": []
+  },
   "sha256:ace3bb1219fb7306585ab9f4d94d41af7ee064c343db0498173436bbe857bd49": {
    "apk": {},
    "brotli": null,