diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json
index 45b05bc1..28d6e5d4 100644
--- a/documentation/security-watch/state.json
+++ b/documentation/security-watch/state.json
@@ -1,5 +1,19 @@
 {
  "advisories": {
+  "calcom/cal.com|GHSA-cpf2-q635-xrwx": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "calcom/cal.com v6.2.0 (calcom)",
+   "silent": "first read after the seed",
+   "summary": "Not expiring old sessions after enabling 2FA"
+  },
+  "calcom/cal.com|GHSA-p3f6-52gv-cj7m": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "calcom/cal.com v6.2.0 (calcom)",
+   "silent": "first read after the seed",
+   "summary": "Repository takeover via `.github/workflows/pr.yml`"
+  },
   "cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -12,198 +26,12 @@
    "program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
    "summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server"
   },
-  "codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
-   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
-  },
-  "codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
-   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
-  },
-  "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
-   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
-  },
-  "codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
-   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
-  },
-  "codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
-   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
-  },
-  "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
-   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
-  },
   "docmost/docmost|release:docmost/docmost@v0.97.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
    "program": "docmost/docmost 0.96.0 (docmost)",
    "summary": "This release includes security fixes for the latest Node"
   },
-  "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Stored XSS in SVG Hotlinks"
-  },
-  "f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "File Request MaxSize Limit Bypassed in File Request"
-  },
-  "f0rc3/gokapi|GHSA-4xg4-54hm-9j77": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Stored XSS vulnerability in friendly name for API keys"
-  },
-  "f0rc3/gokapi|GHSA-95rc-wc32-gm53": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Stored XSS by uploading file with malicious file name"
-  },
-  "f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Data Leak in Upload Status Stream"
-  },
-  "f0rc3/gokapi|GHSA-hcff-qv74-7hr4": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "CSRF in Login Endpoint"
-  },
-  "f0rc3/gokapi|GHSA-j6jp-78w8-34x6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Privilege Escalation in File Replace"
-  },
-  "f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Privilege escalation with auth token"
-  },
-  "f0rc3/gokapi|GHSA-q658-hfpg-35qc": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion"
-  },
-  "f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
-   "summary": "DoS in API endpoint"
-  },
-  "fallenbagel/jellyseerr|GHSA-8j73-j6rc-q8xh": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Third-party notification credentials of other users exposed via request detail endpoints"
-  },
-  "fallenbagel/jellyseerr|GHSA-f7xw-jcqr-57hp": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials"
-  },
-  "fallenbagel/jellyseerr|GHSA-gx3h-3jg5-q65f": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Missing authentication on pushSubscription endpoints"
-  },
-  "fallenbagel/jellyseerr|GHSA-mc6w-69r3-62h8": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Path traversal to RCE via /avatarproxy image cache filename from upstream ETag"
-  },
-  "fallenbagel/jellyseerr|GHSA-rc4w-7m3r-c2f7": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint"
-  },
-  "fallenbagel/jellyseerr|GHSA-xc6j-6p6h-p799": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
-   "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
-  },
-  "flomp/wanderer-db|GHSA-332v-mq7g-5hqf": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
-  },
-  "flomp/wanderer-db|GHSA-3xp7-7492-j2q6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
-  },
-  "flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
-  },
-  "flomp/wanderer-db|GHSA-fprh-3pp9-68m9": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
-  },
-  "flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
-  },
-  "flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
-  },
-  "flomp/wanderer-db|GHSA-vj82-xj83-jp85": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
-  },
-  "flomp/wanderer-db|GHSA-vprp-gr6m-j375": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
-  },
-  "flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
-   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
-  },
   "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -216,60 +44,6 @@
    "program": "flomp/wanderer-db v0.20.0 (wanderer)",
    "summary": "( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )"
   },
-  "flomp/wanderer-web|GHSA-332v-mq7g-5hqf": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
-  },
-  "flomp/wanderer-web|GHSA-3xp7-7492-j2q6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
-  },
-  "flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
-  },
-  "flomp/wanderer-web|GHSA-fprh-3pp9-68m9": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
-  },
-  "flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
-  },
-  "flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
-  },
-  "flomp/wanderer-web|GHSA-vj82-xj83-jp85": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
-  },
-  "flomp/wanderer-web|GHSA-vprp-gr6m-j375": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
-  },
-  "flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
-   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
-  },
   "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -294,24 +68,6 @@
    "program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)",
    "summary": "1 (October 2026 security release)"
   },
-  "ghcr.io/alam00000/bentopdf|GHSA-5xjf-rr5x-pcfj": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
-   "summary": "SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass"
-  },
-  "ghcr.io/alam00000/bentopdf|GHSA-cx8x-7rrr-r9x8": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
-   "summary": "Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests"
-  },
-  "ghcr.io/alam00000/bentopdf|GHSA-wh78-rcw2-hhg9": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
-   "summary": "SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker"
-  },
   "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -336,17 +92,12 @@
    "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
    "summary": "org/en/blog/vulnerability/october-2026-security-releases"
   },
-  "ghcr.io/home-assistant/home-assistant|GHSA-jff5-5j3g-vhqc": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)",
-   "summary": "Actions expression injection in `helpers/version/action.yml`"
-  },
-  "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
-   "summary": "One-click account takeover via XSS in login page continue redirect"
+  "ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)",
+   "silent": "first read after the seed",
+   "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints"
   },
   "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": {
    "first": "2026-10-26",
@@ -354,24 +105,12 @@
    "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
    "summary": "com/ ) as well as some  nodejs security patches"
   },
-  "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
-   "summary": "One-click account takeover via XSS in login page continue redirect"
-  },
   "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
    "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
    "summary": "com/ ) as well as some  nodejs security patches"
   },
-  "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
-   "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV"
-  },
   "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -384,6 +123,202 @@
    "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
    "summary": "This is a security release on top of 0"
   },
+  "ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Cross-user nested automation execution bypasses ownership checks and runs actions with victim privileges"
+  },
+  "ghcr.io/lukegus/termix|GHSA-6gr3-r7jx-wfmh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Two-factor authentication can be bypassed via a forged client-supplied device identifier"
+  },
+  "ghcr.io/lukegus/termix|GHSA-7j7m-85p4-2cpm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Authentication Bypass by Spoofing and Improper Restriction of Excessive Authentication Attempts in Termix"
+  },
+  "ghcr.io/lukegus/termix|GHSA-fj9w-vcj9-66qh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Termix: the automation `run_command` step substitutes untrusted template values straight into a shell command, ignoring the quoting contract its own template mo"
+  },
+  "ghcr.io/lukegus/termix|GHSA-frx8-qqgg-7j7g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Termix Desktop: any website can obtain a session on the embedded backend (CORS allows all origins + passwordless loopback auto-session)"
+  },
+  "ghcr.io/lukegus/termix|GHSA-hmv7-25x4-vp6w": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Termix: a read-only session-share guest can delete its own participant record and then type into the owner's live SSH session, turning a \"watch only\" link into "
+  },
+  "ghcr.io/lukegus/termix|GHSA-j7j4-82wh-3vj5": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "LDAPS certificate validation is disabled, allowing MITM capture of LDAP and user credentials"
+  },
+  "ghcr.io/lukegus/termix|GHSA-r7x4-j6x8-jxrx": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Authenticated users can mint Guacamole tokens for arbitrary RDP/VNC/Telnet targets"
+  },
+  "ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft"
+  },
+  "ghcr.io/lukegus/termix|GHSA-rgf3-2q88-q4wp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Cross-User File Manager SSH Session Termination and State Replacement"
+  },
+  "ghcr.io/lukegus/termix|GHSA-v3vp-ffww-q7pw": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "Credential disclosure vulnerability in Termix"
+  },
+  "ghcr.io/lukegus/termix|GHSA-wv2p-5jqw-9qf3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
+   "silent": "first read after the seed",
+   "summary": "User-controlled Vault address is fetched without SSRF controls"
+  },
+  "ghcr.io/mealie-recipes/mealie|GHSA-99wf-32rc-2767": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/mealie-recipes/mealie v3.28.0 (mealie)",
+   "silent": "first read after the seed",
+   "summary": "Recipe zip import lets a user take over another group's tools and read another group's recipes"
+  },
+  "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
+   "silent": "first read after the seed",
+   "summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled"
+  },
+  "ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
+   "silent": "first read after the seed",
+   "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-4gp5-59x3-vhhg": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": " Homebox generic notifier SSRF via HTTP redirect after URL validation"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-4p8r-vm9v-c9pm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-58m4-m8xj-v3j2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Unauthenticated /api/v1/users/register lacks rate limiting while Argon2id runs per request (default-enabled) — resource exhaustion DoS"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-59cq-p2m6-hh23": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "API keys are not revoked on password change and never expire by default, so a leaked key survives full credential rotation"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-754m-5j7m-8wfv": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Unauthenticated X-Forwarded-Host injection into /swagger/doc.json lets an attacker control the host of the served OpenAPI spec (host-header injection / cache po"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-g3p9-jfjj-pqgw": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "No Mechanism to Revoke Other Active Sessions on Login or Logout, Allowing Persistent Stolen-Token Access"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-h7wm-wjr6-cfxh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "CSV formula injection in entities export and bill-of-materials export"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-j935-m3f2-frrj": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "EntityRepository.UpdateByGroup mutates custom Fields on another tenant's item — outer entity update is group-scoped, but the Fields create/update/delete block i"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-jm28-2xm3-m6m5": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Group members can rename, delete, and take over groups they don't own"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-mw9p-fhpj-jf82": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Invitation usage limit is raceable, oversubscribing a group beyond the owner-granted quota in Homebox"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-rhfm-x4x2-p3qr": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "SSRF via generic:// notifier with insecure defaults allows authenticated users to reach localhost and internal network services"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-wxcf-4p4j-vhvg": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Cross-Tenant IDOR in Entity Update Endpoint Leaks Full Entity Data Across Group Boundaries"
+  },
+  "ghcr.io/sysadminsmedia/homebox|GHSA-xqg9-6xxv-3452": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "silent": "first read after the seed",
+   "summary": "Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service"
+  },
   "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -396,12 +331,397 @@
    "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
    "summary": "Warning  This release is a security release to patch a NodeJS upstream vulnerability"
   },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Recipe import subsystem: XXE local file read via lxml default parser (rezeptsuitede/Cookmate XML importers) and SSRF in the pestle importer left out of the GHSA"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-5p9v-743w-79h3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Shopping-list bulk create accepts foreign-Space Food/Unit/Ingredient IDs and returns their names"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-69q3-5q6x-7hmx": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Group-Permission Cache Key Omits Active Space"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-748x-xc8h-95hj": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "User can move an owned entry into another user’s unshared recipe book"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Any user can read other spaces' meal plans via mealplan_id on shopping list entries"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-cqj3-64qw-4w52": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-pcq2-64qw-jm4x": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Private recipe overview disclosed through ShoppingListRecipe API in 2.6.15"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-vc5c-xh64-79vp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Fix for GHSA-5mw3-c978-gc6w checks UserSpace ids against User ids"
+  },
+  "ghcr.io/tandoorrecipes/recipes|GHSA-xq7g-9q95-vjc6": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "silent": "first read after the seed",
+   "summary": "Server-Side Request Forgery (SSRF) in Pestle Recipe Import"
+  },
   "ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
    "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
    "summary": "fixed  shopping list bulk API endpoint accepted IDs from foreign spaces  GHSA-5p9v-743w-79h3"
   },
+  "gitea/gitea|GHSA-467c-4w7p-8427": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Algorithmic Complexity DoS in Issue Reference Parsing"
+  },
+  "gitea/gitea|GHSA-469m-x4mw-38r3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "OAuth access tokens can be exchanged as refresh tokens"
+  },
+  "gitea/gitea|GHSA-4j4g-m7mr-hp5j": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency"
+  },
+  "gitea/gitea|GHSA-4jmf-h2cm-hg7w": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`"
+  },
+  "gitea/gitea|GHSA-54w9-6cc5-9wj9": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false"
+  },
+  "gitea/gitea|GHSA-6f9g-7jgm-m5ph": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS"
+  },
+  "gitea/gitea|GHSA-6g2h-xpg3-rm48": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings"
+  },
+  "gitea/gitea|GHSA-6pv5-8rp7-8c75": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one"
+  },
+  "gitea/gitea|GHSA-7769-9pr9-m24h": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Deploy keys impersonate the repository owner in the hook pipeline"
+  },
+  "gitea/gitea|GHSA-7cq7-4v93-8wjm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)"
+  },
+  "gitea/gitea|GHSA-7v5j-mph8-9w6g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller"
+  },
+  "gitea/gitea|GHSA-8hhh-mqpg-jpxc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy"
+  },
+  "gitea/gitea|GHSA-8j56-f865-gqq2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Draft releases include attachment metadata from other repositories"
+  },
+  "gitea/gitea|GHSA-8pwg-hcgm-54cp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup"
+  },
+  "gitea/gitea|GHSA-93pj-3x56-5gc2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Cancelled fork-PR Actions jobs are revived by later approval"
+  },
+  "gitea/gitea|GHSA-94rx-fqm6-q23v": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Stored XSS via Repository Media API"
+  },
+  "gitea/gitea|GHSA-96qg-qxxj-r8xq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments"
+  },
+  "gitea/gitea|GHSA-9h7g-h754-c8x2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification"
+  },
+  "gitea/gitea|GHSA-c3cr-qq9g-666c": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users"
+  },
+  "gitea/gitea|GHSA-cwq7-782w-pxcc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases"
+  },
+  "gitea/gitea|GHSA-fqjr-23c8-gg9m": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS"
+  },
+  "gitea/gitea|GHSA-fx95-gwfc-grgc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public"
+  },
+  "gitea/gitea|GHSA-fxq4-gr55-7x5g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels"
+  },
+  "gitea/gitea|GHSA-g4hw-fg4c-89mq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches"
+  },
+  "gitea/gitea|GHSA-hcgw-r9gf-8mph": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories"
+  },
+  "gitea/gitea|GHSA-hf55-9cwq-2x64": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs"
+  },
+  "gitea/gitea|GHSA-jj5r-9rpc-8h6h": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti"
+  },
+  "gitea/gitea|GHSA-mf69-7pqq-86vx": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover"
+  },
+  "gitea/gitea|GHSA-mw6q-qj47-9g5q": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash"
+  },
+  "gitea/gitea|GHSA-p3pc-g8m5-hrrr": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection"
+  },
+  "gitea/gitea|GHSA-p3rv-cr5f-9gjh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation"
+  },
+  "gitea/gitea|GHSA-pvjf-7jrm-6w9g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun"
+  },
+  "gitea/gitea|GHSA-rqhx-647v-wx32": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "SSRF via HTTP Redirect in Repository Migration"
+  },
+  "gitea/gitea|GHSA-vcp6-2qc6-gvq3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys"
+  },
+  "gitea/gitea|GHSA-vvqw-mjq8-x248": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs"
+  },
+  "gitea/gitea|GHSA-wx44-9m3m-rjqx": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Locked issues and comments still accept reactions through the web UI"
+  },
+  "gitea/gitea|GHSA-x4q3-gcj3-m6cf": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"
+  },
+  "gitea/gitea|GHSA-x8c3-3rp8-2j46": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "API team demotion does not reset unit permissions"
+  },
+  "gitea/gitea|GHSA-xfqq-h54g-92f8": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access"
+  },
+  "gitea/gitea|GHSA-xh39-mxw9-34pp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ"
+  },
+  "gitea/gitea|GHSA-xmfc-hqq8-33wh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "gitea/gitea 1.27.3 (gitea)",
+   "silent": "first read after the seed",
+   "summary": "Private profile information leaks on POST request"
+  },
+  "glanceapp/glance|GHSA-r225-jhr6-68cc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "glanceapp/glance v0.8.5 (glance)",
+   "silent": "first read after the seed",
+   "summary": "Unauthenticated login requests can cause unbounded memory consumption"
+  },
+  "grafana/grafana|GHSA-2x6g-h2hg-rq84": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "grafana/grafana 13.2.3 (grafana)",
+   "silent": "first read after the seed",
+   "summary": "Email addresses and usernames can not be trusted"
+  },
+  "grafana/grafana|GHSA-4724-7jwc-3fpw": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "grafana/grafana 13.2.3 (grafana)",
+   "silent": "first read after the seed",
+   "summary": "Spoofing originalUrl of snapshots"
+  },
+  "grafana/grafana|GHSA-8wjh-59cw-9xh4": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "grafana/grafana 13.2.3 (grafana)",
+   "silent": "first read after the seed",
+   "summary": "Forward OAuth Identity Token can allow users to access some data sources"
+  },
+  "grafana/grafana|GHSA-8xmm-x63g-f6xv": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "grafana/grafana 13.2.3 (grafana)",
+   "silent": "first read after the seed",
+   "summary": "Stored XSS in ResourcePicker component "
+  },
   "grafana/grafana|release:grafana/grafana@v13.2.4": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -624,48 +944,6 @@
    "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
    "summary": "[High] TOTP re-enrollment via  POST /api/auth/otp/generate  and  POST /api/auth/otp/verify  no longer allows anonymous callers to replace an existing second fac"
   },
-  "jellyfin/jellyfin|GHSA-4vx8-xhc9-qg6x": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": " Broken access control in session remote-control API"
-  },
-  "jellyfin/jellyfin|GHSA-6828-c7cx-hvqm": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": " Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories"
-  },
-  "jellyfin/jellyfin|GHSA-9x85-gx46-6522": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": "Potential IDOR in playlist management"
-  },
-  "jellyfin/jellyfin|GHSA-c39p-cgf8-866g": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": "Potential path transversal exposure in PluginsController.cs"
-  },
-  "jellyfin/jellyfin|GHSA-cf3c-8m59-2vhx": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": "Memory exhaustion and SSRF via external references in user-supplied SVG images"
-  },
-  "jellyfin/jellyfin|GHSA-hw73-62vp-9gxf": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
-   "summary": "Potential path transversal exposure in HlsSegmentController.cs"
-  },
-  "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
-   "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
-  },
   "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.6": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -696,12 +974,6 @@
    "program": "lscr.io/linuxserver/code-server 4.129.0 (code-server)",
    "summary": "Brotli decoder ( CVE-2026-111497 )"
   },
-  "lukevella/rallly|GHSA-gmq4-f8j5-8w8q": {
-   "first": "2026-10-26",
-   "last_mailed": "2026-10-26",
-   "program": "lukevella/rallly 4.15.3 (rallly)",
-   "summary": "Remote code execution in poll preview images via vulnerable Next.js next/og"
-  },
   "lukevella/rallly|release:lukevella/rallly@v4.15.4": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -726,18 +998,228 @@
    "program": "lukevella/rallly 4.15.3 (rallly)",
    "summary": "js security update"
   },
+  "n8nio/n8n|GHSA-365g-vjw2-grx8": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host"
+  },
+  "n8nio/n8n|GHSA-43v8-hjhm-chjp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Chat Hub: chat-only users can register tool types the product already tries to sandbox"
+  },
+  "n8nio/n8n|GHSA-65mv-v8rp-54wc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Quick Base Node Allows Filter Injection Through the Where Parameter"
+  },
+  "n8nio/n8n|GHSA-8crx-5h96-q72q": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard"
+  },
+  "n8nio/n8n|GHSA-8vrr-mgc5-jg55": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value"
+  },
+  "n8nio/n8n|GHSA-crfj-5wv6-8v86": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data"
+  },
+  "n8nio/n8n|GHSA-m7gv-mpg5-7c9v": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block"
+  },
+  "n8nio/n8n|GHSA-mgpr-56r4-5c67": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes"
+  },
+  "n8nio/n8n|GHSA-mp7q-23hg-35cf": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting"
+  },
+  "n8nio/n8n|GHSA-pcr3-v5vr-qppf": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Per-User Credential Theft via Error-Workflow Execution Context Inheritance"
+  },
+  "n8nio/n8n|GHSA-qmvv-q3c9-wpp7": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Credential Secrets Exposed in Execution Error Data of Several Nodes"
+  },
+  "n8nio/n8n|GHSA-v9cx-v88r-42vw": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted"
+  },
+  "n8nio/n8n|GHSA-wvjj-qg37-pv73": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "n8nio/n8n 2.42.1 (n8n)",
+   "silent": "first read after the seed",
+   "summary": "Crafted Workflow ID Gives Access to Data Tables in Other Projects"
+  },
+  "outlinewiki/outline|GHSA-27h6-gg7j-wj5w": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Cross-tenant authorization gap in the GitLab integration inbound-webhook handler"
+  },
+  "outlinewiki/outline|GHSA-48rq-wx9j-g949": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)"
+  },
+  "outlinewiki/outline|GHSA-65xg-84g9-7hrm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Existing collaboration connection remains writable after document archive or deletion"
+  },
+  "outlinewiki/outline|GHSA-97vv-f6qq-6842": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence"
+  },
+  "outlinewiki/outline|GHSA-cprf-crfh-w3p4": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)"
+  },
+  "outlinewiki/outline|GHSA-f28f-75h4-499q": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback"
+  },
+  "outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Authenticated members can publish documents into private collections through a retained parent link"
+  },
+  "outlinewiki/outline|GHSA-m9vh-j2wc-xj24": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)"
+  },
+  "outlinewiki/outline|GHSA-rq53-m97j-f2pg": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked"
+  },
+  "outlinewiki/outline|GHSA-rvj7-2gww-6xfq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member"
+  },
+  "outlinewiki/outline|GHSA-w8vg-8mjx-xq8x": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets"
+  },
+  "outlinewiki/outline|GHSA-x4w3-9p9j-cprh": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "silent": "first read after the seed",
+   "summary": "users.update_role reveals whether a user id from another team exists and which role it has"
+  },
   "outlinewiki/outline|release:outline/outline@v1.12.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
    "program": "outlinewiki/outline 1.10.1 (outline)",
    "summary": "1 which fixes multiple recently disclosed  vulnerabilities"
   },
+  "privatebin/pdo|GHSA-w873-3ghv-hmh6": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "privatebin/pdo 2.0.6 (privatebin)",
+   "silent": "first read after the seed",
+   "summary": "Insufficient Markdown/HTML Sanitization enables Deceptive Popups due to Bootstrap classes"
+  },
   "privatebin/pdo|release:PrivateBin/PrivateBin@2.1.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
    "program": "privatebin/pdo 2.0.6 (privatebin)",
    "summary": "More details on this issue can be found in the security advisory:"
   },
+  "rommapp/romm|GHSA-722m-w9p2-xv2j": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "silent": "first read after the seed",
+   "summary": "Unauthenticated WebSocket Scan Trigger"
+  },
+  "rommapp/romm|GHSA-7jw3-ppmp-57wc": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "silent": "first read after the seed",
+   "summary": "RomM hidden ROM child routes bypass entity visibility restrictions and allow unauthorized media modification"
+  },
+  "rommapp/romm|GHSA-9q83-m866-5jrp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "silent": "first read after the seed",
+   "summary": "RomM Public Save Download Endpoint Bypasses Hidden ROM Visibility and Leaks Protected Save Files"
+  },
+  "rommapp/romm|GHSA-q7fg-rj3q-m3gm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "silent": "first read after the seed",
+   "summary": "Any user can read and download other users' private collections and Favourites via `/api/roms` collection filters"
+  },
   "rommapp/romm|release:rommapp/romm@5.4.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -840,6 +1322,307 @@
    "program": "traefik v3.7.13 (controller infra)",
    "summary": "Advisory  GHSA-hrpp-p4fc-wwf8"
   },
+  "vikunja/vikunja|GHSA-2f75-93c9-xf32": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Stored rich-text images make viewers' clients probe loopback and LAN addresses"
+  },
+  "vikunja/vikunja|GHSA-3x3m-2j93-w46j": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Unbounded avatar size cache exhausts server memory"
+  },
+  "vikunja/vikunja|GHSA-49pj-52x6-8gpj": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "No brute-force limit on password re-authentication; TOTP can be disabled with the password alone"
+  },
+  "vikunja/vikunja|GHSA-4hv6-xc92-j86g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes"
+  },
+  "vikunja/vikunja|GHSA-4qvp-948j-4cgv": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Revoked session's access token keeps working and can mint new credentials"
+  },
+  "vikunja/vikunja|GHSA-586f-48mj-3rwr": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Read-only project members see credential-bearing webhook URLs"
+  },
+  "vikunja/vikunja|GHSA-5f6v-j6xm-wwj9": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Project-webhook token scope reaches user-level webhooks"
+  },
+  "vikunja/vikunja|GHSA-5fc2-w2j4-6r8w": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Bot API tokens keep working after the bot owner's account is disabled or locked"
+  },
+  "vikunja/vikunja|GHSA-5q33-h98p-rgh9": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Webhook task payloads bypass read authorization via a no-op kanban bucket move"
+  },
+  "vikunja/vikunja|GHSA-66cq-j6rw-pjch": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Webhook payloads leak related tasks from projects the webhook owner can't read"
+  },
+  "vikunja/vikunja|GHSA-7f23-p76f-cx74": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Unbounded resize output in task-attachment image preview enables in-process API OOM (unfixed sibling of CVE-2026-91971)"
+  },
+  "vikunja/vikunja|GHSA-7gmh-4fw6-8xc5": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Export archives are orphaned on disk and never cleaned up"
+  },
+  "vikunja/vikunja|GHSA-9hxw-pxcq-4q8q": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Image decodes have no concurrency bound"
+  },
+  "vikunja/vikunja|GHSA-9rfw-7hv4-3vv3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Local file storage blobs and SQLite database are world-readable"
+  },
+  "vikunja/vikunja|GHSA-9xh7-5jg8-mf43": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Bucket delete uses the URL view instead of the bucket's real view"
+  },
+  "vikunja/vikunja|GHSA-c934-xjq2-mrg3": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "CalDAV VTODO RELATED-TO entries fan out into unbounded dummy tasks"
+  },
+  "vikunja/vikunja|GHSA-ff52-3296-2fvr": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Link-share hash logged in the request path"
+  },
+  "vikunja/vikunja|GHSA-fjrf-gjmg-9v6g": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Team members cannot be removed after a client writes `external_id`"
+  },
+  "vikunja/vikunja|GHSA-fmmf-xq98-g327": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Write-level project members can delete admin-tier link shares through an unloaded permission check"
+  },
+  "vikunja/vikunja|GHSA-fprf-r6rv-xg99": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Saved filter creation with an empty filter string recalculates task positions across all tenants"
+  },
+  "vikunja/vikunja|GHSA-frf4-3prf-3vch": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Login CSRF via form-encoded login and OIDC callback on /api/v2"
+  },
+  "vikunja/vikunja|GHSA-g2xc-jv9q-46wq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "WeKan and vikunja-file imports have no item-count cap, enabling in-process API OOM (unfixed variant of CVE-2026-91969)"
+  },
+  "vikunja/vikunja|GHSA-h4q3-mc9r-q7vv": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "TOTP can be enrolled and enabled without the password, letting a stolen session lock the owner out"
+  },
+  "vikunja/vikunja|GHSA-h8wj-3gwg-jjjg": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Release toolchain (xgo) pulled by mutable ref"
+  },
+  "vikunja/vikunja|GHSA-hjx8-qv73-f7cm": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed"
+  },
+  "vikunja/vikunja|GHSA-hm4w-h7v8-ch43": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Nil bucket filter makes project view reads panic"
+  },
+  "vikunja/vikunja|GHSA-hq66-9qg8-jwqg": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Account deletion escalates read-only shares to project admin or owner"
+  },
+  "vikunja/vikunja|GHSA-hrw2-p27j-8mj8": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Plugin and log directories not re-anchored to the rootpath"
+  },
+  "vikunja/vikunja|GHSA-j5v7-qcwp-5g32": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "API token scopes collide between v1 and v2, granting a different verb than intended"
+  },
+  "vikunja/vikunja|GHSA-m687-p538-r5hp": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted"
+  },
+  "vikunja/vikunja|GHSA-mqq8-869v-48q8": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Vikunja-file ZIP import has no entry-count cap"
+  },
+  "vikunja/vikunja|GHSA-p23m-cq25-pc4j": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Stored CSS injection in rich-text (TipTap) renderer via table-cell data-background-color"
+  },
+  "vikunja/vikunja|GHSA-p697-wq4x-grpj": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Unbounded bucket count causes per-bucket query fan-out on kanban reads"
+  },
+  "vikunja/vikunja|GHSA-pjr3-86v4-5p7w": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regressi"
+  },
+  "vikunja/vikunja|GHSA-qf5p-grf5-wcq4": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Password-reset, email-confirm and account-deletion tokens in the URL query reach access logs"
+  },
+  "vikunja/vikunja|GHSA-rj93-wmch-2crq": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Changing the API URL sends stored auth tokens to the new origin"
+  },
+  "vikunja/vikunja|GHSA-rp33-8f2m-hm6j": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "HTML injection in conversational notification email headers via unescaped doer name and task/project titles (incomplete fix of GHSA-45q4-x4r9-8fqj)"
+  },
+  "vikunja/vikunja|GHSA-rp64-xg8g-9mpr": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Dump archive is created with umask permissions"
+  },
+  "vikunja/vikunja|GHSA-v3r6-33v3-79c2": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Team self-removal endpoint reveals whether a private team exists"
+  },
+  "vikunja/vikunja|GHSA-v579-5fwc-gr28": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "page=0 on v1 list endpoints returns the whole result set, bypassing service.maxitemsperpage"
+  },
+  "vikunja/vikunja|GHSA-w64q-7p4m-j8g8": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Kanban task-bucket move lets a user put a task into another project's bucket"
+  },
+  "vikunja/vikunja|GHSA-wqjr-22r7-5437": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Trello, Todoist and Microsoft To Do migrations buffer remote downloads and API responses without limits, enabling in-process API OOM"
+  },
+  "vikunja/vikunja|GHSA-xgw3-ccqg-f6ww": {
+   "first": "2026-10-27",
+   "last_mailed": "2026-10-27",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "silent": "first read after the seed",
+   "summary": "Migration OAuth callbacks are not bound to the initiating user"
+  },
   "vikunja/vikunja|release:go-vikunja/vikunja@v2.7.0": {
    "first": "2026-10-26",
    "last_mailed": "2026-10-26",
@@ -853,42 +1636,13 @@
    "summary": "🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes"
   }
  },
- "failures": {},
- "seed_pending": [
-  "actualbudget/actual-server",
-  "calcom/cal.com",
-  "deluan/navidrome",
-  "freikin/dawarich",
-  "getmeili/meilisearch",
-  "ghcr.io/alexta69/metube",
-  "ghcr.io/diced/zipline",
-  "ghcr.io/gethomepage/homepage",
-  "ghcr.io/lukegus/termix",
-  "ghcr.io/mealie-recipes/mealie",
-  "ghcr.io/paperless-ngx/paperless-ngx",
-  "ghcr.io/papra-hq/papra",
-  "ghcr.io/sysadminsmedia/homebox",
-  "ghcr.io/tandoorrecipes/recipes",
-  "ghost",
-  "gitea/gitea",
-  "glanceapp/glance",
-  "gotson/komga",
-  "grafana/grafana",
-  "lscr.io/linuxserver/bookstack",
-  "lscr.io/linuxserver/code-server",
-  "lscr.io/linuxserver/prowlarr",
-  "lscr.io/linuxserver/radarr",
-  "lscr.io/linuxserver/sabnzbd",
-  "lscr.io/linuxserver/transmission",
-  "n8nio/n8n",
-  "nginx",
-  "outlinewiki/outline",
-  "privatebin/pdo",
-  "rommapp/romm",
-  "vaultwarden/server",
-  "vikunja/vikunja",
-  "wger/server"
- ],
+ "failures": {
+  "registry:docker.io": {
+   "mailed": false,
+   "streak": 1
+  }
+ },
+ "seed_pending": [],
  "seeded_at": "2026-10-26",
  "version": 1,
  "weekly_last": "2026-10-26"