admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-watch: memory of 2026-11-09 (R-1303). Docs only.

Browse Source
This commit is contained in:
felhom security watch committed 2026-11-09 03:44:09 +00:00
1 parent 2f1096794f
commit 68b1dc201a
1 file changed
+105 -105
Download Patch File Download Diff File Expand all files Collapse all files
documentation/security-watch/state.json
+105 -105
View File
@@ -106,7 +106,7 @@
},
"dooplex:actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)",
"summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection"
},
@@ -214,13 +214,13 @@
},
"dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)",
"summary": "1 introduces important security fixes"
},
"dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)",
"summary": "1 introduces important security fixes"
},
@@ -431,7 +431,7 @@
},
"dooplex:gitea/gitea|GHSA-32h8-5xqg-h466": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Actions: fork workflow gets secrets and write token via review commit_id"
},
@@ -443,13 +443,13 @@
},
"dooplex:gitea/gitea|GHSA-37xv-m4w7-j2fh": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public-only tokens bypass private-resource restrictions on the admin API"
},
"dooplex:gitea/gitea|GHSA-3fv3-hhmm-4x2q": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-"
},
@@ -544,7 +544,7 @@
},
"dooplex:gitea/gitea|GHSA-5j4v-rwqr-vpq7": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users"
},
@@ -606,7 +606,7 @@
},
"dooplex:gitea/gitea|GHSA-6h2f-c8jm-84hc": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)"
},
@@ -670,7 +670,7 @@
},
"dooplex:gitea/gitea|GHSA-8g99-g36h-5p2w": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public-only package tokens can access private OCI blobs"
},
@@ -690,7 +690,7 @@
},
"dooplex:gitea/gitea|GHSA-8p3x-w464-4g6v": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username"
},
@@ -709,7 +709,7 @@
},
"dooplex:gitea/gitea|GHSA-8r36-6j2c-3gmv": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos"
},
@@ -785,7 +785,7 @@
},
"dooplex:gitea/gitea|GHSA-9v6p-xpcp-7488": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header"
},
@@ -798,7 +798,7 @@
},
"dooplex:gitea/gitea|GHSA-c45m-jm46-mwxg": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public project boards disclose private pull request titles and repository names"
},
@@ -967,7 +967,7 @@
},
"dooplex:gitea/gitea|GHSA-jr76-w9m3-3p68": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds "
},
@@ -1004,7 +1004,7 @@
},
"dooplex:gitea/gitea|GHSA-mf6p-vqpw-3r7x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Actions token can spoof instance-signed commits by adding a GPG key"
},
@@ -1043,7 +1043,7 @@
},
"dooplex:gitea/gitea|GHSA-p86q-78gw-8f3f": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep"
},
@@ -1092,7 +1092,7 @@
},
"dooplex:gitea/gitea|GHSA-q9gm-9c7q-c5hq": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)"
},
@@ -1104,13 +1104,13 @@
},
"dooplex:gitea/gitea|GHSA-qcgm-ggp8-22qc": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets"
},
"dooplex:gitea/gitea|GHSA-r6mh-qg79-rqj2": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)"
},
@@ -1178,7 +1178,7 @@
},
"dooplex:gitea/gitea|GHSA-vmrc-8q2x-573x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "API Issue Mutation Archive Restriction Bypass"
},
@@ -1246,7 +1246,7 @@
},
"dooplex:gitea/gitea|GHSA-wxcq-p34j-7cjj": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public-only tokens expose private repositories through profile and organization tabs"
},
@@ -1258,7 +1258,7 @@
},
"dooplex:gitea/gitea|GHSA-x5v4-836g-f95x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories"
},
@@ -1428,13 +1428,13 @@
},
"dooplex:louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)"
},
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
@@ -1481,7 +1481,7 @@
},
"dooplex:outlinewiki/outline|release:outline/outline@v1.12.0": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "outlinewiki/outline 1.10.1 (outline)",
"summary": "1 which fixes multiple recently disclosed vulnerabilities"
},
@@ -1565,7 +1565,7 @@
},
"dooplex:rommapp/romm|release:rommapp/romm@5.4.1": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "rommapp/romm 5.3.1 (romm)",
"summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
},
@@ -1577,13 +1577,13 @@
},
"dooplex:vaultwarden/server|GHSA-9pjj-f9g5-3x4c": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)",
"summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4"
},
"dooplex:vaultwarden/server|GHSA-x9cq-f669-vrr4": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)",
"summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5"
},
@@ -1697,13 +1697,13 @@
},
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "getmeili/meilisearch v1.36.0 (wanderer)",
"summary": "1 introduces important security fixes"
},
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "getmeili/meilisearch v1.36.0 (wanderer)",
"summary": "1 introduces important security fixes"
},
@@ -1844,61 +1844,61 @@
},
"gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Moving or renaming a folder retargets public shares to the whole folder"
},
"gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
},
"gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
},
"gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
},
"gtstef/filebrowser|GHSA-4v62-884x-2466": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
},
"gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
},
"gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
},
"gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
},
"gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
},
"gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
},
@@ -1910,145 +1910,145 @@
},
"gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Logout Bypass via Alternate JWT Spelling"
},
"gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
},
"gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
},
"gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Read-only users can overwrite files through PUT /api/resources"
},
"gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
},
"gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
},
"gtstef/filebrowser|GHSA-cw65-p35p-633w": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
},
"gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
},
"gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Custom API token with no global caps inherits owner admin access"
},
"gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
},
"gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
},
"gtstef/filebrowser|GHSA-p93p-v944-4p44": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
},
"gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
},
"gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
},
"gtstef/filebrowser|GHSA-qv53-4557-m65h": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
},
"gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
},
"gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
},
"gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
},
"gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
},
"gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
},
"gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
},
"gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
},
"gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
},
"gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"last_mailed": "2026-11-09",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share authorization gaps let read-only users delete files"
},
@@ -2262,33 +2262,6 @@
"python": null,
"unchecked": []
},
"sha256:055a930b0c556f4114408b7c145087ef362c01991446f6e20ad164d4eb4d9f0d": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:3a6a9b1bf8404bbde5c7ff3bb79b5a28af2867198cc2fa0aa74eae9fe00281ba",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:05c1454f9a32967affc1f34f67f8cc0cc57dd805dca45489fe797095a6286556": {
"apk": {
"brotli-libs": "1.2.1-r0",
"python3": "3.14.10-r1"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:53b6b44f1c99fae7c823cf2cebebe75372f8080c95a31269491cc2672b474957",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:06cf186569cf58d93e12659ff1a517b65b5b0ebee7050a3991d4bd8a1d398da6": {
"apk": {},
"brotli": null,
@@ -2704,6 +2677,20 @@
"python": null,
"unchecked": []
},
"sha256:3d4c4545d51a690a0df15a2ff99038823a88a9822df8e794526447b9afbd7384": {
"apk": {
"brotli-libs": "1.2.1-r0",
"python3": "3.14.10-r1"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:c848051844a2e2c34e557cafe74f548fe46b3fa27560e3af95904c3a51284b2b",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
"apk": {},
"brotli": null,
@@ -2855,6 +2842,19 @@
"python": null,
"unchecked": []
},
"sha256:51a9ac2a9eb47afc833541e5fd6c11b86eb9f810694c22fa2429e3078e9194b2": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:90fc402fd050506460369cf263feb1193888ebd06cbf5fa665e9a247f9c02b83",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:54d9406cd30f9e206a9dd6d61dfac48da26b9afc37200e14f23beb8fafa7d11c": {
"apk": {
"brotli-libs": "1.2.0-r1"
@@ -3610,19 +3610,6 @@
"python": null,
"unchecked": []
},
"sha256:ade5937813c6ae415b29db729386e53fea3ecf067a019849bafbe2d2a6ec02ba": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:6c8e1bca60c0100ebff5fef5c98d4a72255786b98ce4700440b4d2c52dad37d3",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8": {
"apk": {
"brotli-libs": "1.1.0-r1"
@@ -4058,6 +4045,19 @@
"python": null,
"unchecked": []
},
"sha256:e4e34a0a84f407b1bcd2c3b6cd1999bf99bcad1defa8847adea7dc82a9cd6b8c": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:803047b6179f709c21a3d5db2a7e33641d5cda779bc94149fa90791d105feb5a",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:e88415a90dd2f7efecdbc18de0490aff292764a3ac471531bf1d0481725591bd": {
"apk": {},
"brotli": null,
@@ -4276,5 +4276,5 @@
"seed_pending": [],
"seeded_at": "2026-10-26",
"version": 1,
"weekly_last": "2026-11-02"
"weekly_last": "2026-11-09"
}