From 329d769d89b8089f8264d281534f6e8b06019b0e Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Tue, 3 Nov 2026 03:44:53 +0000 Subject: [PATCH] security-watch: memory of 2026-11-03 (R-1303). Docs only. --- documentation/security-watch/state.json | 509 ++++++++---------------- 1 file changed, 174 insertions(+), 335 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index 7a138935..c7783e83 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -1,17 +1,5 @@ { "advisories": { - "actualbudget/actual-server|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", - "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "actualbudget/actual-server 26.9.0 (actualbudget)", - "summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection" - }, "calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -20,14 +8,14 @@ }, "calcom/cal.com|GHSA-cpf2-q635-xrwx": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "calcom/cal.com v6.2.0 (calcom)", "silent": "first read after the seed", "summary": "Not expiring old sessions after enabling 2FA" }, "calcom/cal.com|GHSA-p3f6-52gv-cj7m": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "calcom/cal.com v6.2.0 (calcom)", "silent": "first read after the seed", "summary": "Repository takeover via `.github/workflows/pr.yml`" @@ -220,7 +208,7 @@ }, "dooplex:ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)", "silent": "first read after the seed", "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints" @@ -461,14 +449,14 @@ }, "dooplex:gitea/gitea|GHSA-467c-4w7p-8427": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Algorithmic Complexity DoS in Issue Reference Parsing" }, "dooplex:gitea/gitea|GHSA-469m-x4mw-38r3": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "OAuth access tokens can be exchanged as refresh tokens" @@ -487,14 +475,14 @@ }, "dooplex:gitea/gitea|GHSA-4j4g-m7mr-hp5j": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency" }, "dooplex:gitea/gitea|GHSA-4jmf-h2cm-hg7w": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`" @@ -507,7 +495,7 @@ }, "dooplex:gitea/gitea|GHSA-54w9-6cc5-9wj9": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false" @@ -580,14 +568,14 @@ }, "dooplex:gitea/gitea|GHSA-6f9g-7jgm-m5ph": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS" }, "dooplex:gitea/gitea|GHSA-6g2h-xpg3-rm48": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" @@ -606,14 +594,14 @@ }, "dooplex:gitea/gitea|GHSA-6pv5-8rp7-8c75": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one" }, "dooplex:gitea/gitea|GHSA-7769-9pr9-m24h": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Deploy keys impersonate the repository owner in the hook pipeline" @@ -626,7 +614,7 @@ }, "dooplex:gitea/gitea|GHSA-7cq7-4v93-8wjm": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)" @@ -639,7 +627,7 @@ }, "dooplex:gitea/gitea|GHSA-7v5j-mph8-9w6g": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller" @@ -664,14 +652,14 @@ }, "dooplex:gitea/gitea|GHSA-8hhh-mqpg-jpxc": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy" }, "dooplex:gitea/gitea|GHSA-8j56-f865-gqq2": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Draft releases include attachment metadata from other repositories" @@ -690,7 +678,7 @@ }, "dooplex:gitea/gitea|GHSA-8pwg-hcgm-54cp": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" @@ -727,14 +715,14 @@ }, "dooplex:gitea/gitea|GHSA-93pj-3x56-5gc2": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cancelled fork-PR Actions jobs are revived by later approval" }, "dooplex:gitea/gitea|GHSA-94rx-fqm6-q23v": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Stored XSS via Repository Media API" @@ -753,14 +741,14 @@ }, "dooplex:gitea/gitea|GHSA-96qg-qxxj-r8xq": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments" }, "dooplex:gitea/gitea|GHSA-9h7g-h754-c8x2": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification" @@ -779,7 +767,7 @@ }, "dooplex:gitea/gitea|GHSA-c3cr-qq9g-666c": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" @@ -798,7 +786,7 @@ }, "dooplex:gitea/gitea|GHSA-cwq7-782w-pxcc": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases" @@ -829,7 +817,7 @@ }, "dooplex:gitea/gitea|GHSA-fqjr-23c8-gg9m": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS" @@ -860,14 +848,14 @@ }, "dooplex:gitea/gitea|GHSA-fxq4-gr55-7x5g": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels" }, "dooplex:gitea/gitea|GHSA-g4hw-fg4c-89mq": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches" @@ -904,7 +892,7 @@ }, "dooplex:gitea/gitea|GHSA-hcgw-r9gf-8mph": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories" @@ -917,7 +905,7 @@ }, "dooplex:gitea/gitea|GHSA-hf55-9cwq-2x64": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs" @@ -942,7 +930,7 @@ }, "dooplex:gitea/gitea|GHSA-jj5r-9rpc-8h6h": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti" @@ -985,7 +973,7 @@ }, "dooplex:gitea/gitea|GHSA-mf69-7pqq-86vx": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" @@ -1004,21 +992,21 @@ }, "dooplex:gitea/gitea|GHSA-mw6q-qj47-9g5q": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash" }, "dooplex:gitea/gitea|GHSA-p3pc-g8m5-hrrr": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection" }, "dooplex:gitea/gitea|GHSA-p3rv-cr5f-9gjh": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation" @@ -1055,7 +1043,7 @@ }, "dooplex:gitea/gitea|GHSA-pvjf-7jrm-6w9g": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun" @@ -1140,7 +1128,7 @@ }, "dooplex:gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" @@ -1159,7 +1147,7 @@ }, "dooplex:gitea/gitea|GHSA-vcp6-2qc6-gvq3": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" @@ -1178,7 +1166,7 @@ }, "dooplex:gitea/gitea|GHSA-vvqw-mjq8-x248": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs" @@ -1227,7 +1215,7 @@ }, "dooplex:gitea/gitea|GHSA-wx44-9m3m-rjqx": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Locked issues and comments still accept reactions through the web UI" @@ -1258,28 +1246,28 @@ }, "dooplex:gitea/gitea|GHSA-x8c3-3rp8-2j46": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "API team demotion does not reset unit permissions" }, "dooplex:gitea/gitea|GHSA-xfqq-h54g-92f8": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access" }, "dooplex:gitea/gitea|GHSA-xh39-mxw9-34pp": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ" }, "dooplex:gitea/gitea|GHSA-xmfc-hqq8-33wh": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Private profile information leaks on POST request" @@ -1316,28 +1304,28 @@ }, "dooplex:grafana/grafana|GHSA-2x6g-h2hg-rq84": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Email addresses and usernames can not be trusted" }, "dooplex:grafana/grafana|GHSA-4724-7jwc-3fpw": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Spoofing originalUrl of snapshots" }, "dooplex:grafana/grafana|GHSA-8wjh-59cw-9xh4": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Forward OAuth Identity Token can allow users to access some data sources" }, "dooplex:grafana/grafana|GHSA-8xmm-x63g-f6xv": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Stored XSS in ResourcePicker component " @@ -1392,35 +1380,35 @@ }, "dooplex:outlinewiki/outline|GHSA-cprf-crfh-w3p4": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "outlinewiki/outline 1.10.1 (outline)", "silent": "first read after the seed", "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)" }, "dooplex:outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "outlinewiki/outline 1.10.1 (outline)", "silent": "first read after the seed", "summary": "Authenticated members can publish documents into private collections through a retained parent link" }, "dooplex:outlinewiki/outline|GHSA-rq53-m97j-f2pg": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "outlinewiki/outline 1.10.1 (outline)", "silent": "first read after the seed", "summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked" }, "dooplex:outlinewiki/outline|GHSA-rvj7-2gww-6xfq": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "outlinewiki/outline 1.10.1 (outline)", "silent": "first read after the seed", "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member" }, "dooplex:outlinewiki/outline|GHSA-x4w3-9p9j-cprh": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "outlinewiki/outline 1.10.1 (outline)", "silent": "first read after the seed", "summary": "users.update_role reveals whether a user id from another team exists and which role it has" @@ -1667,7 +1655,7 @@ }, "ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft" @@ -1692,206 +1680,74 @@ }, "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", "silent": "first read after the seed", "summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled" }, "ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", "silent": "first read after the seed", "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents" }, "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Any user can read other spaces' meal plans via mealplan_id on shopping list entries" }, "ghcr.io/tandoorrecipes/recipes|GHSA-cqj3-64qw-4w52": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints" }, - "gitea/gitea|GHSA-32h8-5xqg-h466": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Actions: fork workflow gets secrets and write token via review commit_id" - }, - "gitea/gitea|GHSA-37xv-m4w7-j2fh": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public-only tokens bypass private-resource restrictions on the admin API" - }, - "gitea/gitea|GHSA-3fv3-hhmm-4x2q": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-" - }, - "gitea/gitea|GHSA-5j4v-rwqr-vpq7": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users" - }, - "gitea/gitea|GHSA-6h2f-c8jm-84hc": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)" - }, - "gitea/gitea|GHSA-8g99-g36h-5p2w": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public-only package tokens can access private OCI blobs" - }, - "gitea/gitea|GHSA-8p3x-w464-4g6v": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username" - }, - "gitea/gitea|GHSA-8r36-6j2c-3gmv": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos" - }, - "gitea/gitea|GHSA-9v6p-xpcp-7488": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header" - }, - "gitea/gitea|GHSA-c45m-jm46-mwxg": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public project boards disclose private pull request titles and repository names" - }, - "gitea/gitea|GHSA-jh8p-x4ch-389q": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public-Only Token Bypass on Bulk Organization Repository Deletion" - }, - "gitea/gitea|GHSA-jr76-w9m3-3p68": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds " - }, - "gitea/gitea|GHSA-mf6p-vqpw-3r7x": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Actions token can spoof instance-signed commits by adding a GPG key" - }, - "gitea/gitea|GHSA-p86q-78gw-8f3f": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep" - }, - "gitea/gitea|GHSA-q9gm-9c7q-c5hq": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)" - }, - "gitea/gitea|GHSA-qcgm-ggp8-22qc": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets" - }, - "gitea/gitea|GHSA-r6mh-qg79-rqj2": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)" - }, "gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" }, - "gitea/gitea|GHSA-vmrc-8q2x-573x": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "API Issue Mutation Archive Restriction Bypass" - }, - "gitea/gitea|GHSA-wxcq-p34j-7cjj": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Public-only tokens expose private repositories through profile and organization tabs" - }, - "gitea/gitea|GHSA-x5v4-836g-f95x": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories" - }, - "gitea/gitea|release:go-gitea/gitea@v28.3.0": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "gitea/gitea 28.2.0 (gitea)", - "summary": "0 [security] ( #40050 ) ( #40051 )" - }, "glanceapp/glance|GHSA-r225-jhr6-68cc": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "glanceapp/glance v0.8.5 (glance)", "silent": "first read after the seed", "summary": "Unauthenticated login requests can cause unbounded memory consumption" }, "grafana/grafana|GHSA-2x6g-h2hg-rq84": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Email addresses and usernames can not be trusted" }, "grafana/grafana|GHSA-4724-7jwc-3fpw": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Spoofing originalUrl of snapshots" }, "grafana/grafana|GHSA-8wjh-59cw-9xh4": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Forward OAuth Identity Token can allow users to access some data sources" }, "grafana/grafana|GHSA-8xmm-x63g-f6xv": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Stored XSS in ResourcePicker component " }, - "grafana/grafana|release:grafana/grafana@v13.2.5": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", - "summary": "Security: Fix CVE-2026-100105" - }, "grafana/grafana|release:grafana/grafana@v13.3.0": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -2114,24 +1970,12 @@ "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share authorization gaps let read-only users delete files" }, - "louislam/uptime-kuma|GHSA-86ch-2247-gr56": { - "first": "2026-11-01", - "last_mailed": "2026-11-01", - "program": "louislam/uptime-kuma 2.5.7 (uptime-kuma)", - "summary": "Unauthenticated Host-header injection and RSS cache poisoning" - }, "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, - "louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "louislam/uptime-kuma 2.5.7 (uptime-kuma)", - "summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)" - }, "n8nio/n8n|GHSA-2x68-96jw-5r6c": { "first": "2026-10-29", "last_mailed": "2026-10-29", @@ -2140,7 +1984,7 @@ }, "n8nio/n8n|GHSA-365g-vjw2-grx8": { "first": "2026-10-27", - "last_mailed": "2026-10-27", + "last_mailed": "2026-11-03", "program": "n8nio/n8n 2.42.1 (n8n)", "silent": "first read after the seed", "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host" @@ -2228,24 +2072,6 @@ "last_mailed": "2026-10-28", "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "traefik|GHSA-xv5x-242w-7hf7": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "traefik v3.7.16 (controller infra)", - "summary": "Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)" - }, - "vaultwarden/server|GHSA-9pjj-f9g5-3x4c": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "vaultwarden/server 1.37.4-alpine (vaultwarden)", - "summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4" - }, - "vaultwarden/server|GHSA-x9cq-f669-vrr4": { - "first": "2026-11-02", - "last_mailed": "2026-11-02", - "program": "vaultwarden/server 1.37.4-alpine (vaultwarden)", - "summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5" } }, "failures": {}, @@ -2315,6 +2141,19 @@ "python": null, "unchecked": [] }, + "sha256:06cf186569cf58d93e12659ff1a517b65b5b0ebee7050a3991d4bd8a1d398da6": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:c56adb686c5b72d755a4958905a27212edc6be27d065ebe3cb470c95c552df89", + "dpkg": {}, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:08ee9ffdb847e1bd35ded30ee832090dd06a7f93f67422687db59e70bc7f5393": { "apk": {}, "brotli": null, @@ -2393,17 +2232,6 @@ "python": null, "unchecked": [] }, - "sha256:1336e85aaed293bd63d005086e0dd013b04078b26aaeb1c18b26a2f928af7e65": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:abb2b9c1b132b5b0be40d09c85bf8d3dab2a59fa0eb3aa955ab8be5efbb73de6", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:19764751d501495b021530c9426f25d8f9f8748dc38ab3ba48eb62d7df2cd92e": { "apk": {}, "brotli": null, @@ -2430,19 +2258,6 @@ "python": null, "unchecked": [] }, - "sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:7d90670a4e2531e752f014e58f7283b9d197847b6f073bf84e99598f49d80ffd", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:1a078b237c1d9b420b0ee59147386b4aa60d3a07a8e6a402fc84a57e41b043a4": { "apk": {}, "brotli": null, @@ -2674,19 +2489,6 @@ "python": null, "unchecked": [] }, - "sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:d154aee25ff14e9545e3e32ccbcf0c1bfd5654d12fb513f52d242e9202687d32", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:3084f1e5ecdc10afafc193911039a06cdabda4473f3a48d62edbe460e3c154ee": { "apk": {}, "brotli": null, @@ -2700,6 +2502,17 @@ "python": null, "unchecked": [] }, + "sha256:30ff62491aacdb862ceb8c9edcf2627da638d7deafdd4b6dab32fe34f8aa3e90": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:c999a937a1bb51ba36c79adf2c9db1d1bb196896b66d524d30ef4945606d565f", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:32ab73d80f2b8b5fb0735b0431deb36b93fbb6b2fb43592449b0178c8b83e350": { "apk": {}, "brotli": null, @@ -2711,6 +2524,19 @@ "python": null, "unchecked": [] }, + "sha256:33f61a72d9aaa021f7e687987b9fcb992673d9ca3fc08f63f5ddaddf59e94efc": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:04a0776853e8ae87a9005ce334aed98c0006bae68d1206c5e7fbcbe4e7a78247", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2815,6 +2641,21 @@ "python": null, "unchecked": [] }, + "sha256:4384b9ff20a78bc1708c35ce7864f84f724611de7801fb36d715998db7c000f1": { + "apk": { + "brotli-libs": "1.2.0-r1" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:76507b062b1b63966557dc42048005720fa2c3185c9d1600cc67ae71a65f1cde", + "dpkg": {}, + "env": { + "NODE_VERSION": "26.12.1-r0" + }, + "node": "26.12.1-r0", + "python": null, + "unchecked": [] + }, "sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb": { "apk": { "brotli-libs": "1.1.0-r1" @@ -2893,23 +2734,6 @@ "python": null, "unchecked": [] }, - "sha256:4b95dbe7ac5343b768f8e04e3035ccd59997872b1a35ab9b0f082d2cc279070e": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:2e1a606449aab9b7577620ec87554c71e924d8f3dedd50e69b938c63c8d5d1b9", - "dpkg": { - "libbrotli1": "1.0.9-2+b6", - "python3": "3.11.2-1+b1", - "python3.11": "3.11.2-6+deb12u9" - }, - "env": { - "NODE_VERSION": "22.23.4" - }, - "node": "22.23.4", - "python": null, - "unchecked": [] - }, "sha256:4d7cd163d60c81c257badef488707601fa02c56368894bde4af69839fc761d69": { "apk": {}, "brotli": null, @@ -2981,19 +2805,6 @@ "python": null, "unchecked": [] }, - "sha256:552beab3dec8c93d46b8b9245612d63c3f123b8a45063a474f53e229b17621d3": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:59cab86c77e764855119e2d5ddd96b9c9cefd90913f4feed7f4ee1433a6482c5", - "dpkg": {}, - "env": { - "NODE_VERSION": "24.20.0" - }, - "node": "24.20.0", - "python": null, - "unchecked": [] - }, "sha256:568b1be1c42f456df066a8bb55be8ce0046b2c6fc96b1650db5d2162eb4f1ce9": { "apk": {}, "brotli": null, @@ -3344,6 +3155,19 @@ "python": null, "unchecked": [] }, + "sha256:8967bf9deaf3c5c4adae13519436dc1b20c646ac83fe37ae810c933a1045227d": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:411af83e9be78029c0047a5f5a72f1d91b7c793ba5e5813b4e70a6bb8e4a0738", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:8974eaa9ba32f713daf311e7cc8cd7e4cdfba1edea39eed75524e78ef4b08f4f": { "apk": { "brotli-libs": "1.0.9-r14" @@ -3440,21 +3264,6 @@ "python": null, "unchecked": [] }, - "sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:7a7708314f9b1d0656e2e7f697abb64fae5f76e1895f0a9ccb9036c3933a0394", - "dpkg": {}, - "env": { - "NODE_VERSION": "26.12.1-r0" - }, - "node": "26.12.1-r0", - "python": null, - "unchecked": [] - }, "sha256:97ec88159e6d7cfb5ddef9015386087d58a912de80112f06ebdfa78fa5989901": { "apk": {}, "brotli": null, @@ -3537,11 +3346,13 @@ "python": null, "unchecked": [] }, - "sha256:a0225d1ea6631c8bc2385dc4c2faba17bbf1834ecf369e1659a9a382bd8d5dd7": { - "apk": {}, + "sha256:9f7aa1e1e3246aade5792d35a738049f7f32f89cd51d1956cf426a4e86268a84": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, "brotli": null, "brotlicffi": null, - "digest": "sha256:5cf1e1293ea42e077e6a22114e6773b9aae3bb8f9933a2acd5a9721518ff8f5b", + "digest": "sha256:ffeeebf613b00fede764821c5e5b1545fb376aba561ae91c488e91f219adb25a", "dpkg": {}, "env": {}, "node": null, @@ -3634,6 +3445,17 @@ "python": null, "unchecked": [] }, + "sha256:a81d043930e51745522bd5c430961cf8286f0a23f0a9a2a6e0108f7ea71b0902": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:72c368d898861f3b3a07af0e6d690400f44f048799ed46822783d9224cc2c86d", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:ace3bb1219fb7306585ab9f4d94d41af7ee064c343db0498173436bbe857bd49": { "apk": {}, "brotli": null, @@ -3806,6 +3628,19 @@ "python": null, "unchecked": [] }, + "sha256:bbe684a02d6b0db54256ff88eac9754f4519284a7b26314afc241fd7d0918191": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:bda2ee084beddcb179ca433a2c24a548205fef9d3807319e3d27aed02eeed3ce", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:bc5a392672c1ec8823c50b61f3bd4b7e5acc34fcbb8477862577b3af1c633875": { "apk": {}, "brotli": null, @@ -4047,19 +3882,6 @@ "python": null, "unchecked": [] }, - "sha256:da6324232770050b7d5f6222e8f4e223f1c688363b02ebb3c15a7546dd7133d5": { - "apk": { - "brotli-libs": "1.2.1-r0" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:b7c7030d23f421ec2a64cd16f505ec315d1ed66ce9870bd2c1c4513e38282e28", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f": { "apk": { "brotli-libs": "1.2.0-r1" @@ -4099,6 +3921,23 @@ "python": null, "unchecked": [] }, + "sha256:e88415a90dd2f7efecdbc18de0490aff292764a3ac471531bf1d0481725591bd": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:92eb954ce9a68eca749efe76ef9c6dffe43d23a56ed68f35f3866a29f7108b6e", + "dpkg": { + "libbrotli1": "1.0.9-2+b6", + "python3": "3.11.2-1+b1", + "python3.11": "3.11.2-6+deb12u9" + }, + "env": { + "NODE_VERSION": "22.23.4" + }, + "node": "22.23.4", + "python": null, + "unchecked": [] + }, "sha256:e9733bafb1bdef9b00e25a21f8f99dc26a22224bf16641ad754d1649f4c3357a": { "apk": {}, "brotli": null,