From 9b4b5fe5e7f7ce9f4355d7c7628e038cf50df3ee Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Wed, 28 Oct 2026 03:42:17 +0000 Subject: [PATCH] security-watch: memory of 2026-10-28 (R-1303). Docs only. --- documentation/security-watch/state.json | 1985 ++++++++++++++--------- 1 file changed, 1191 insertions(+), 794 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index a64790d5..b9f5e35e 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -1,5 +1,23 @@ { "advisories": { + "actualbudget/actual-server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", + "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "advplyr/audiobookshelf|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "advplyr/audiobookshelf 2.37.1 (audiobookshelf-system/audiobookshelf.yaml)", + "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "calcom/cal.com|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "calcom/cal.com v6.2.0 (calcom)", + "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" + }, "calcom/cal.com|GHSA-cpf2-q635-xrwx": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -20,17 +38,221 @@ "program": "cloudflare/cloudflared 2026.10.3 (controller infra)", "summary": "8 eMudhra certificates are compromised. Here's what you need to know" }, - "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.4:VULN-176088": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "cloudflare/cloudflared 2026.10.3 (controller infra)", - "summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server" + "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.5:VULN-183456": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "cloudflare/cloudflared 2026.10.4 (controller infra)", + "summary": "- 2026-10-26 VULN-183456: Bump github.com/go-chi/chi/v5 to v5.5.0" }, - "docmost/docmost|release:docmost/docmost@v0.97.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "docmost/docmost 0.96.0 (docmost)", - "summary": "This release includes security fixes for the latest Node" + "codewithcj/sparkyfitness_server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", + "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts" + }, + "codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", + "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" + }, + "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", + "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno" + }, + "codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", + "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts" + }, + "codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", + "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" + }, + "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", + "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno" + }, + "crocodilestick/calibre-web-automated|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" + }, + "docker.io/calcom/cal.com|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "docker.io/calcom/cal.com v6.2.0 (booking-system/booking.yaml)", + "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" + }, + "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Stored XSS in SVG Hotlinks" + }, + "f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "File Request MaxSize Limit Bypassed in File Request" + }, + "f0rc3/gokapi|GHSA-4xg4-54hm-9j77": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Stored XSS vulnerability in friendly name for API keys" + }, + "f0rc3/gokapi|GHSA-95rc-wc32-gm53": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Stored XSS by uploading file with malicious file name" + }, + "f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Data Leak in Upload Status Stream" + }, + "f0rc3/gokapi|GHSA-hcff-qv74-7hr4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "CSRF in Login Endpoint" + }, + "f0rc3/gokapi|GHSA-j6jp-78w8-34x6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Privilege Escalation in File Replace" + }, + "f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Privilege escalation with auth token" + }, + "f0rc3/gokapi|GHSA-q658-hfpg-35qc": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion" + }, + "f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "f0rc3/gokapi v1.9.6 (gokapi)", + "summary": "DoS in API endpoint" + }, + "fallenbagel/jellyseerr|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Node.js 22.18.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "fallenbagel/jellyseerr|GHSA-8j73-j6rc-q8xh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Third-party notification credentials of other users exposed via request detail endpoints" + }, + "fallenbagel/jellyseerr|GHSA-f7xw-jcqr-57hp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials" + }, + "fallenbagel/jellyseerr|GHSA-gx3h-3jg5-q65f": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Missing authentication on pushSubscription endpoints" + }, + "fallenbagel/jellyseerr|GHSA-mc6w-69r3-62h8": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Path traversal to RCE via /avatarproxy image cache filename from upstream ETag" + }, + "fallenbagel/jellyseerr|GHSA-rc4w-7m3r-c2f7": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint" + }, + "fallenbagel/jellyseerr|GHSA-xc6j-6p6h-p799": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", + "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo" + }, + "flomp/wanderer-db|GHSA-332v-mq7g-5hqf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t" + }, + "flomp/wanderer-db|GHSA-3xp7-7492-j2q6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" + }, + "flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)" + }, + "flomp/wanderer-db|GHSA-fprh-3pp9-68m9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" + }, + "flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" + }, + "flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验" + }, + "flomp/wanderer-db|GHSA-vj82-xj83-jp85": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o" + }, + "flomp/wanderer-db|GHSA-vprp-gr6m-j375": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" + }, + "flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list" }, "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": { "first": "2026-10-26", @@ -44,6 +266,66 @@ "program": "flomp/wanderer-db v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, + "flomp/wanderer-web|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "flomp/wanderer-web|GHSA-332v-mq7g-5hqf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t" + }, + "flomp/wanderer-web|GHSA-3xp7-7492-j2q6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" + }, + "flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)" + }, + "flomp/wanderer-web|GHSA-fprh-3pp9-68m9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" + }, + "flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" + }, + "flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验" + }, + "flomp/wanderer-web|GHSA-vj82-xj83-jp85": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o" + }, + "flomp/wanderer-web|GHSA-vprp-gr6m-j375": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" + }, + "flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list" + }, "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", @@ -56,41 +338,35 @@ "program": "flomp/wanderer-web v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, + "freikin/dawarich|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "freikin/dawarich 1.15.3 (dawarich)", + "summary": "Node.js 20.19.2 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" + }, "freikin/dawarich|release:Freika/dawarich@1.17.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "freikin/dawarich 1.15.3 (dawarich)", "summary": "js 20 package, which no longer receives upstream security fixes" }, - "ghcr.io/advplyr/audiobookshelf|release:advplyr/audiobookshelf@v2.37.2": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)", - "summary": "1 (October 2026 security release)" + "ghcr.io/alexta69/metube|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/alexta69/metube 2026.09.29 (metube)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, - "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)", - "summary": "Warning This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 , GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including v2" + "ghcr.io/diced/zipline|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/diced/zipline 4.8.0 (zipline)", + "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.7": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)", - "summary": "Warning This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 , GHSA-5xjf-rr5x-pcfj , GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and " - }, - "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.68.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)", - "summary": "Update dependency nodemailer to v10 [SECURITY] by @renovate [bot] in #798" - }, - "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.69.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)", - "summary": "org/en/blog/vulnerability/october-2026-security-releases" + "ghcr.io/gethomepage/homepage|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml)", + "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": { "first": "2026-10-27", @@ -99,18 +375,174 @@ "silent": "first read after the seed", "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints" }, + "ghcr.io/home-assistant/home-assistant|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-3mh5-gqfm-phgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-72rm-x7xr-v679": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "One-click account takeover via XSS in login page continue redirect" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-c9mf-h82r-8p4j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-g4w3-c888-cr93": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-h5w4-vjv4-9r5q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-hfvf-5c8x-8rc4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-hv27-723h-qfjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-jrp5-g662-hq92": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-q89f-h332-8q2h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" + }, + "ghcr.io/immich-app/immich-machine-learning|GHSA-qp2h-w794-2vhf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" + }, "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)", "summary": "com/ ) as well as some nodejs security patches" }, + "ghcr.io/immich-app/immich-server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Node.js 24.14.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "ghcr.io/immich-app/immich-server|GHSA-3mh5-gqfm-phgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" + }, + "ghcr.io/immich-app/immich-server|GHSA-72rm-x7xr-v679": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" + }, + "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "One-click account takeover via XSS in login page continue redirect" + }, + "ghcr.io/immich-app/immich-server|GHSA-c9mf-h82r-8p4j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" + }, + "ghcr.io/immich-app/immich-server|GHSA-g4w3-c888-cr93": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" + }, + "ghcr.io/immich-app/immich-server|GHSA-h5w4-vjv4-9r5q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" + }, + "ghcr.io/immich-app/immich-server|GHSA-hfvf-5c8x-8rc4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" + }, + "ghcr.io/immich-app/immich-server|GHSA-hv27-723h-qfjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " + }, + "ghcr.io/immich-app/immich-server|GHSA-jrp5-g662-hq92": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" + }, + "ghcr.io/immich-app/immich-server|GHSA-q89f-h332-8q2h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" + }, + "ghcr.io/immich-app/immich-server|GHSA-qp2h-w794-2vhf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" + }, "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)", "summary": "com/ ) as well as some nodejs security patches" }, + "ghcr.io/karakeep-app/karakeep|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", + "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV" + }, "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", @@ -123,6 +555,12 @@ "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", "summary": "This is a security release on top of 0" }, + "ghcr.io/lukegus/termix|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/lukegus/termix release-2.9.2 (termix-system/termix.yaml)", + "summary": "Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, "ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -207,12 +645,11 @@ "silent": "first read after the seed", "summary": "User-controlled Vault address is fetched without SSRF controls" }, - "ghcr.io/mealie-recipes/mealie|GHSA-99wf-32rc-2767": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/mealie-recipes/mealie v3.28.0 (mealie)", - "silent": "first read after the seed", - "summary": "Recipe zip import lets a user take over another group's tools and read another group's recipes" + "ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": { "first": "2026-10-27", @@ -228,108 +665,35 @@ "silent": "first read after the seed", "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents" }, - "ghcr.io/sysadminsmedia/homebox|GHSA-4gp5-59x3-vhhg": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": " Homebox generic notifier SSRF via HTTP redirect after URL validation" + "ghcr.io/papra-hq/papra|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/papra-hq/papra 26.6.2-rootless (papra)", + "summary": "Node.js 26.4.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "ghcr.io/sysadminsmedia/homebox|GHSA-4p8r-vm9v-c9pm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay" + "ghcr.io/seanmorley15/adventurelog-backend|release:seanmorley15/AdventureLog@v0.13.1": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/seanmorley15/adventurelog-backend v0.13.0 (adventurelog)", + "summary": "This release includes security updates for the backend, frontend, and container images" }, - "ghcr.io/sysadminsmedia/homebox|GHSA-58m4-m8xj-v3j2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Unauthenticated /api/v1/users/register lacks rate limiting while Argon2id runs per request (default-enabled) — resource exhaustion DoS" + "ghcr.io/seanmorley15/adventurelog-frontend|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)", + "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "ghcr.io/sysadminsmedia/homebox|GHSA-59cq-p2m6-hh23": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "API keys are not revoked on password change and never expire by default, so a leaked key survives full credential rotation" + "ghcr.io/seanmorley15/adventurelog-frontend|release:seanmorley15/AdventureLog@v0.13.1": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)", + "summary": "This release includes security updates for the backend, frontend, and container images" }, - "ghcr.io/sysadminsmedia/homebox|GHSA-754m-5j7m-8wfv": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Unauthenticated X-Forwarded-Host injection into /swagger/doc.json lets an attacker control the host of the served OpenAPI spec (host-header injection / cache po" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-g3p9-jfjj-pqgw": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "No Mechanism to Revoke Other Active Sessions on Login or Logout, Allowing Persistent Stolen-Token Access" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-h7wm-wjr6-cfxh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "CSV formula injection in entities export and bill-of-materials export" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-j935-m3f2-frrj": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "EntityRepository.UpdateByGroup mutates custom Fields on another tenant's item — outer entity update is group-scoped, but the Fields create/update/delete block i" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-jm28-2xm3-m6m5": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Group members can rename, delete, and take over groups they don't own" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-mw9p-fhpj-jf82": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Invitation usage limit is raceable, oversubscribing a group beyond the owner-granted quota in Homebox" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-rhfm-x4x2-p3qr": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "SSRF via generic:// notifier with insecure defaults allows authenticated users to reach localhost and internal network services" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-wxcf-4p4j-vhvg": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Cross-Tenant IDOR in Entity Update Endpoint Leaks Full Entity Data Across Group Boundaries" - }, - "ghcr.io/sysadminsmedia/homebox|GHSA-xqg9-6xxv-3452": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "silent": "first read after the seed", - "summary": "Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service" - }, - "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "summary": "Security Issues Patched" - }, - "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.1": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", - "summary": "Warning This release is a security release to patch a NodeJS upstream vulnerability" + "ghcr.io/tandoorrecipes/recipes|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": { "first": "2026-10-27", @@ -400,6 +764,72 @@ "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "summary": "fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3" }, + "ghost|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghost 6.67.0-alpine (ghost)", + "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "gitea/gitea|GHSA-25gq-j9jx-43pg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)" + }, + "gitea/gitea|GHSA-2fcr-jfvc-vgg2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Two SSRF findings in Gitea 1.26.2" + }, + "gitea/gitea|GHSA-2m9v-5q2g-58vq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Git LFS object reuse allows non-Code access to authorize private source objects" + }, + "gitea/gitea|GHSA-2r5c-gw76-rh3w": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter" + }, + "gitea/gitea|GHSA-2wm4-vwp6-v7xc": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata" + }, + "gitea/gitea|GHSA-2xph-7j4g-43rg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)" + }, + "gitea/gitea|GHSA-36q5-5423-vgx2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory" + }, + "gitea/gitea|GHSA-3pww-vcvm-3gmj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data" + }, + "gitea/gitea|GHSA-3r5c-2xxx-h872": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Webhook Authorization Header Returned in Plaintext via API" + }, + "gitea/gitea|GHSA-44qc-pgvp-wx7v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Notification API leaks private issue metadata after access revocation" + }, "gitea/gitea|GHSA-467c-4w7p-8427": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -414,6 +844,18 @@ "silent": "first read after the seed", "summary": "OAuth access tokens can be exchanged as refresh tokens" }, + "gitea/gitea|GHSA-46c7-w5w4-h644": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Email Management API Bypasses ManageCredentials Feature Restrictions" + }, + "gitea/gitea|GHSA-46px-6cqx-c5fv": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Authenticated DoS in OneDev migration via unbounded version response body" + }, "gitea/gitea|GHSA-4j4g-m7mr-hp5j": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -428,6 +870,12 @@ "silent": "first read after the seed", "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`" }, + "gitea/gitea|GHSA-4xjf-493q-98p3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea SSH Key Parser Denial of Service" + }, "gitea/gitea|GHSA-54w9-6cc5-9wj9": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -435,6 +883,66 @@ "silent": "first read after the seed", "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false" }, + "gitea/gitea|GHSA-579w-82gf-89m2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Remote Code Execution via unescaped markup `Context` into external renderer argv" + }, + "gitea/gitea|GHSA-5952-x23q-p23f": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Authenticated DoS in GitLab migration via uncancelable version probe" + }, + "gitea/gitea|GHSA-5ggr-2f2h-jmvm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Local File Inclusion via file:// URI in Migration Restore" + }, + "gitea/gitea|GHSA-5w72-2mqm-qh46": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Wiki-only members can read private pull request titles through markup preview" + }, + "gitea/gitea|GHSA-5xcq-p92v-43rf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Package size quota bypass and unbounded memory read in the Maven checksum upload path" + }, + "gitea/gitea|GHSA-5xp7-r6cr-39ff": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request" + }, + "gitea/gitea|GHSA-66m4-5jjr-2rg5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocatio" + }, + "gitea/gitea|GHSA-683j-3ff6-hh2x": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Privilege Escalation via Access Token Scope Escalation in API" + }, + "gitea/gitea|GHSA-6c6r-5xr4-cr5m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository issue/comment attachment re-linking can expose private attachment content" + }, + "gitea/gitea|GHSA-6cqf-375w-639g": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)" + }, "gitea/gitea|GHSA-6f9g-7jgm-m5ph": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -449,6 +957,12 @@ "silent": "first read after the seed", "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" }, + "gitea/gitea|GHSA-6hm7-3pwj-22rm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload" + }, "gitea/gitea|GHSA-6pv5-8rp7-8c75": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -463,6 +977,12 @@ "silent": "first read after the seed", "summary": "Deploy keys impersonate the repository owner in the hook pipeline" }, + "gitea/gitea|GHSA-777r-4v59-6486": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Permanent Fork PR Workflow Approval Gate Bypass" + }, "gitea/gitea|GHSA-7cq7-4v93-8wjm": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -470,6 +990,12 @@ "silent": "first read after the seed", "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)" }, + "gitea/gitea|GHSA-7p4h-3gxq-x3h3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118" + }, "gitea/gitea|GHSA-7v5j-mph8-9w6g": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -477,6 +1003,18 @@ "silent": "first read after the seed", "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller" }, + "gitea/gitea|GHSA-7w2r-xwp6-mh6c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)" + }, + "gitea/gitea|GHSA-7wvc-rvp7-w99x": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories" + }, "gitea/gitea|GHSA-8hhh-mqpg-jpxc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -491,6 +1029,12 @@ "silent": "first read after the seed", "summary": "Draft releases include attachment metadata from other repositories" }, + "gitea/gitea|GHSA-8p9h-49rc-qgxj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository Visibility Manipulation via Git Push Options" + }, "gitea/gitea|GHSA-8pwg-hcgm-54cp": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -498,6 +1042,30 @@ "silent": "first read after the seed", "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" }, + "gitea/gitea|GHSA-8r3w-5682-jrqf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded gitignores repository-creation field enables linear template-read amplification" + }, + "gitea/gitea|GHSA-8vmh-w35x-73qr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthenticated Blind SSRF via OpenID Sign-In Verification" + }, + "gitea/gitea|GHSA-8xjr-x7rg-hp5h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "2FA bypass and persistent account takeover via OpenID identity linking" + }, + "gitea/gitea|GHSA-92j2-6qcg-c28c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)" + }, "gitea/gitea|GHSA-93pj-3x56-5gc2": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -512,6 +1080,18 @@ "silent": "first read after the seed", "summary": "Stored XSS via Repository Media API" }, + "gitea/gitea|GHSA-94v3-77j7-vm48": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)" + }, + "gitea/gitea|GHSA-96gv-2xc4-4hxj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade" + }, "gitea/gitea|GHSA-96qg-qxxj-r8xq": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -526,6 +1106,12 @@ "silent": "first read after the seed", "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification" }, + "gitea/gitea|GHSA-9mq6-mqjj-c2c5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads" + }, "gitea/gitea|GHSA-c3cr-qq9g-666c": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -533,6 +1119,12 @@ "silent": "first read after the seed", "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" }, + "gitea/gitea|GHSA-cp3q-vrj2-ghhh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents" + }, "gitea/gitea|GHSA-cwq7-782w-pxcc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -540,6 +1132,30 @@ "silent": "first read after the seed", "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases" }, + "gitea/gitea|GHSA-f75j-4cw6-rmx4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`" + }, + "gitea/gitea|GHSA-f8ph-p9p5-vg2p": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthenticated artifact-to-repository oracle in raw Actions downloads" + }, + "gitea/gitea|GHSA-fj8v-hjwv-qm88": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)" + }, + "gitea/gitea|GHSA-fq2p-5p22-8g6j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints" + }, "gitea/gitea|GHSA-fqjr-23c8-gg9m": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -547,6 +1163,30 @@ "silent": "first read after the seed", "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS" }, + "gitea/gitea|GHSA-fqxf-w92m-prvq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Swift registry per-file 128KiB manifest guard bypassed by aggregation" + }, + "gitea/gitea|GHSA-frpv-2xgv-wxpq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in th" + }, + "gitea/gitea|GHSA-frpw-3h2q-4jj6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs" + }, + "gitea/gitea|GHSA-fw57-jgch-pgf3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests" + }, "gitea/gitea|GHSA-fx95-gwfc-grgc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -568,6 +1208,36 @@ "silent": "first read after the seed", "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches" }, + "gitea/gitea|GHSA-g5jj-gp8w-73h7": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess" + }, + "gitea/gitea|GHSA-gx3v-q759-g323": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface" + }, + "gitea/gitea|GHSA-h2x6-g7q6-344v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository migration SSRF via multi-answer DNS allow-list bypass" + }, + "gitea/gitea|GHSA-h56g-4qw7-2mxg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only API token restriction is not enforced on team API routes" + }, + "gitea/gitea|GHSA-h62v-wmrr-5qjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Admin repository collaborator can self-escalate to Owner and transfer the repository" + }, "gitea/gitea|GHSA-hcgw-r9gf-8mph": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -575,6 +1245,12 @@ "silent": "first read after the seed", "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories" }, + "gitea/gitea|GHSA-hch4-r2j8-xm72": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate" + }, "gitea/gitea|GHSA-hf55-9cwq-2x64": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -582,6 +1258,24 @@ "silent": "first read after the seed", "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs" }, + "gitea/gitea|GHSA-hxhc-246f-rvqc": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Organization repository creation endpoint skips repository token scope" + }, + "gitea/gitea|GHSA-j2w3-9c3r-g83q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private Repository Metadata Remains Accessible After Access Revocation" + }, + "gitea/gitea|GHSA-j72v-mjr6-3424": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)" + }, "gitea/gitea|GHSA-jj5r-9rpc-8h6h": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -589,6 +1283,36 @@ "silent": "first read after the seed", "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti" }, + "gitea/gitea|GHSA-jr5x-6h83-wrxf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "REST API exposes organization membership of private organizations to public" + }, + "gitea/gitea|GHSA-m6qc-j894-7h9r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting" + }, + "gitea/gitea|GHSA-m78w-jjjx-gp8r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)" + }, + "gitea/gitea|GHSA-m932-crvm-gcp5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service" + }, + "gitea/gitea|GHSA-m984-2424-x6vw": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Generic attachment downloads bypass draft-release visibility checks" + }, "gitea/gitea|GHSA-mf69-7pqq-86vx": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -596,6 +1320,12 @@ "silent": "first read after the seed", "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" }, + "gitea/gitea|GHSA-mg4f-x9v4-6h2p": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes" + }, "gitea/gitea|GHSA-mw6q-qj47-9g5q": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -617,6 +1347,30 @@ "silent": "first read after the seed", "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation" }, + "gitea/gitea|GHSA-p4mj-98mv-xq26": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint" + }, + "gitea/gitea|GHSA-pgqf-926r-548m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API" + }, + "gitea/gitea|GHSA-pq8x-xpgp-rvmh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Permissive Git hook directory and script modes may allow local code execution as the Gitea service account" + }, + "gitea/gitea|GHSA-prr9-9mp4-5gp2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private org member list leaked via /members API endpoint — incomplete fix for PR #38145" + }, "gitea/gitea|GHSA-pvjf-7jrm-6w9g": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -624,6 +1378,66 @@ "silent": "first read after the seed", "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun" }, + "gitea/gitea|GHSA-px3q-x2mm-55wg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Package registry: restricted users can read packages of limited-visibility users (authorization bypass)" + }, + "gitea/gitea|GHSA-q423-49rw-g9mh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private" + }, + "gitea/gitea|GHSA-q55v-4cmj-xh65": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials" + }, + "gitea/gitea|GHSA-q9pg-jj6x-j9p6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I" + }, + "gitea/gitea|GHSA-r96c-jc75-rxv6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea workflow badge bypasses API token scopes" + }, + "gitea/gitea|GHSA-r9ch-mqjm-g67v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events" + }, + "gitea/gitea|GHSA-rcr6-4jqh-j84m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Remote Code Execution via diffpatch Git Hook Installation" + }, + "gitea/gitea|GHSA-rfm6-r2x5-cg56": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API" + }, + "gitea/gitea|GHSA-rgv6-xp99-6mgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Remember-Me Token Theft Not Invalidating Attacker Session" + }, + "gitea/gitea|GHSA-rh79-75qm-gwjr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea LFS Deploy-Key Privilege Escalation" + }, "gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -631,6 +1445,18 @@ "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" }, + "gitea/gitea|GHSA-v2w8-m4gr-qj65": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation" + }, + "gitea/gitea|GHSA-v73x-hx65-6pf4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthorized Access to Labels of Private Organizations" + }, "gitea/gitea|GHSA-vcp6-2qc6-gvq3": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -638,6 +1464,12 @@ "silent": "first read after the seed", "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" }, + "gitea/gitea|GHSA-vrhc-jjfc-m3m3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)" + }, "gitea/gitea|GHSA-vvqw-mjq8-x248": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -645,6 +1477,48 @@ "silent": "first read after the seed", "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs" }, + "gitea/gitea|GHSA-vxv2-8j6r-pcpg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)" + }, + "gitea/gitea|GHSA-w4wc-g858-3672": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)" + }, + "gitea/gitea|GHSA-w5pg-649r-p6gg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag" + }, + "gitea/gitea|GHSA-wg93-gp4m-c6vr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can read limited-visibility users' issue titles and bodies through issue search" + }, + "gitea/gitea|GHSA-wrf9-r3h7-7x5v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork Synchronization Continues After Parent Repository Changes from Public to Private" + }, + "gitea/gitea|GHSA-ww9q-7j5q-hrv5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Token Scope Bypass on `GET /api/v1/orgs`" + }, + "gitea/gitea|GHSA-wwmh-7r9x-fg49": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can read limited-visibility users’ SSH and GPG keys through the API" + }, "gitea/gitea|GHSA-wx44-9m3m-rjqx": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -659,6 +1533,18 @@ "silent": "first read after the seed", "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled" }, + "gitea/gitea|GHSA-x58h-3mx5-q44r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository migration skips public-only token guard for private repository creation" + }, + "gitea/gitea|GHSA-x77v-q46j-393g": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim" + }, "gitea/gitea|GHSA-x8c3-3rp8-2j46": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -687,6 +1573,36 @@ "silent": "first read after the seed", "summary": "Private profile information leaks on POST request" }, + "gitea/gitea|GHSA-xmj7-xj85-hfc3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL" + }, + "gitea/gitea|GHSA-xv9x-fj9g-vj6h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access" + }, + "gitea/gitea|GHSA-xvfh-qwmh-f92w": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "API routes for user social graph, keys, and starred repos bypass private visibility check" + }, + "gitea/gitea|GHSA-xxjv-752h-3vp2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only repository tokens can update private PR head branches" + }, + "gitea/gitea|release:go-gitea/gitea@v1.27.0": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fix: various security fixes ( #38406 ) ( #38426 )" + }, "glanceapp/glance|GHSA-r225-jhr6-68cc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -722,11 +1638,23 @@ "silent": "first read after the seed", "summary": "Stored XSS in ResourcePicker component " }, - "grafana/grafana|release:grafana/grafana@v13.2.4": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "grafana/grafana 13.2.3 (grafana)", - "summary": "Security: Fix CVE-2026-15577" + "grafana/grafana|release:grafana/grafana@v13.2.5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", + "summary": "Security: Fix CVE-2026-100105" + }, + "grafana/grafana|release:grafana/grafana@v13.3.0": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", + "summary": "Security: Fix CVE-2026-100105" + }, + "gtstef/filebrowser|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gtstef/filebrowser 1.5.8-stable (controller infra)", + "summary": "Alpine brotli-libs 1.2.0-r1 inside the image: the Brotli library of the image's Alpine base (HTTP2Shell)" }, "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": { "first": "2026-10-26", @@ -932,23 +1860,17 @@ "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share authorization gaps let read-only users delete files" }, - "gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.7-stable": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", - "summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac" + "louislam/uptime-kuma|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", + "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.8-stable": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", - "summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac" - }, - "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.6": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", - "summary": "⬆️ Security Fixes" + "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", + "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { "first": "2026-10-26", @@ -962,42 +1884,6 @@ "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, - "lscr.io/linuxserver/bookstack|release:BookStackApp/BookStack@v26.09.2": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lscr.io/linuxserver/bookstack 26.09.1 (bookstack)", - "summary": "Security Release" - }, - "lscr.io/linuxserver/code-server|release:coder/code-server@v4.141.1": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lscr.io/linuxserver/code-server 4.129.0 (code-server)", - "summary": "Brotli decoder ( CVE-2026-111497 )" - }, - "lukevella/rallly|release:lukevella/rallly@v4.15.4": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lukevella/rallly 4.15.3 (rallly)", - "summary": "🔒 Critical security fix: remote code execution in poll preview images" - }, - "lukevella/rallly|release:lukevella/rallly@v4.15.5": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lukevella/rallly 4.15.3 (rallly)", - "summary": "🔒 Security fix: denial of service through Server Actions" - }, - "lukevella/rallly|release:lukevella/rallly@v4.16.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lukevella/rallly 4.15.3 (rallly)", - "summary": "The Control Panel tells you when an update is available and whether it fixes a security issue" - }, - "lukevella/rallly|release:lukevella/rallly@v4.16.2": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "lukevella/rallly 4.15.3 (rallly)", - "summary": "js security update" - }, "n8nio/n8n|GHSA-365g-vjw2-grx8": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1005,117 +1891,11 @@ "silent": "first read after the seed", "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host" }, - "n8nio/n8n|GHSA-43v8-hjhm-chjp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Chat Hub: chat-only users can register tool types the product already tries to sandbox" - }, - "n8nio/n8n|GHSA-65mv-v8rp-54wc": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Quick Base Node Allows Filter Injection Through the Where Parameter" - }, - "n8nio/n8n|GHSA-8crx-5h96-q72q": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard" - }, - "n8nio/n8n|GHSA-8vrr-mgc5-jg55": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value" - }, - "n8nio/n8n|GHSA-crfj-5wv6-8v86": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data" - }, - "n8nio/n8n|GHSA-m7gv-mpg5-7c9v": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block" - }, - "n8nio/n8n|GHSA-mgpr-56r4-5c67": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes" - }, - "n8nio/n8n|GHSA-mp7q-23hg-35cf": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting" - }, - "n8nio/n8n|GHSA-pcr3-v5vr-qppf": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Per-User Credential Theft via Error-Workflow Execution Context Inheritance" - }, - "n8nio/n8n|GHSA-qmvv-q3c9-wpp7": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Credential Secrets Exposed in Execution Error Data of Several Nodes" - }, - "n8nio/n8n|GHSA-v9cx-v88r-42vw": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted" - }, - "n8nio/n8n|GHSA-wvjj-qg37-pv73": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "n8nio/n8n 2.42.1 (n8n)", - "silent": "first read after the seed", - "summary": "Crafted Workflow ID Gives Access to Data Tables in Other Projects" - }, - "outlinewiki/outline|GHSA-27h6-gg7j-wj5w": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Cross-tenant authorization gap in the GitLab integration inbound-webhook handler" - }, - "outlinewiki/outline|GHSA-48rq-wx9j-g949": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)" - }, - "outlinewiki/outline|GHSA-65xg-84g9-7hrm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Existing collaboration connection remains writable after document archive or deletion" - }, - "outlinewiki/outline|GHSA-97vv-f6qq-6842": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence" + "outlinewiki/outline|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "outlinewiki/outline 1.11.0 (outline-system/outline.yaml)", + "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "outlinewiki/outline|GHSA-cprf-crfh-w3p4": { "first": "2026-10-27", @@ -1124,13 +1904,6 @@ "silent": "first read after the seed", "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)" }, - "outlinewiki/outline|GHSA-f28f-75h4-499q": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback" - }, "outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1138,13 +1911,6 @@ "silent": "first read after the seed", "summary": "Authenticated members can publish documents into private collections through a retained parent link" }, - "outlinewiki/outline|GHSA-m9vh-j2wc-xj24": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)" - }, "outlinewiki/outline|GHSA-rq53-m97j-f2pg": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1159,13 +1925,6 @@ "silent": "first read after the seed", "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member" }, - "outlinewiki/outline|GHSA-w8vg-8mjx-xq8x": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets" - }, "outlinewiki/outline|GHSA-x4w3-9p9j-cprh": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1179,52 +1938,83 @@ "program": "outlinewiki/outline 1.10.1 (outline)", "summary": "1 which fixes multiple recently disclosed vulnerabilities" }, - "privatebin/pdo|GHSA-w873-3ghv-hmh6": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "privatebin/pdo 2.0.6 (privatebin)", - "silent": "first read after the seed", - "summary": "Insufficient Markdown/HTML Sanitization enables Deceptive Popups due to Bootstrap classes" + "redis|GHSA-4c68-q8q8-3g4f": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Out of bound read due to a bug in LUA" }, - "privatebin/pdo|release:PrivateBin/PrivateBin@2.1.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "privatebin/pdo 2.0.6 (privatebin)", - "summary": "More details on this issue can be found in the security advisory:" + "redis|GHSA-4q32-c38c-pwgq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Redis DoS Vulnerability due to bad connection error handling" }, - "rommapp/romm|GHSA-722m-w9p2-xv2j": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "rommapp/romm 5.3.1 (romm)", - "silent": "first read after the seed", - "summary": "Unauthenticated WebSocket Scan Trigger" + "redis|GHSA-5453-q98w-cmvm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "redis-check-aof may lead to stack overflow and potential RCE" }, - "rommapp/romm|GHSA-7jw3-ppmp-57wc": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "rommapp/romm 5.3.1 (romm)", - "silent": "first read after the seed", - "summary": "RomM hidden ROM child routes bypass entity visibility restrictions and allow unauthorized media modification" + "redis|GHSA-8ghh-qpmp-7826": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Lua Use-After-Free may lead to remote code execution" }, - "rommapp/romm|GHSA-9q83-m866-5jrp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "rommapp/romm 5.3.1 (romm)", - "silent": "first read after the seed", - "summary": "RomM Public Save Download Endpoint Bypasses Hidden ROM Visibility and Leaks Protected Save Files" + "redis|GHSA-93m2-935m-8rj3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Use-After-Free in unblock client flow may lead to remote code execution" }, - "rommapp/romm|GHSA-q7fg-rj3q-m3gm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "rommapp/romm 5.3.1 (romm)", - "silent": "first read after the seed", - "summary": "Any user can read and download other users' private collections and Favourites via `/api/roms` collection filters" + "redis|GHSA-c8h9-259x-jff4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution" }, - "rommapp/romm|release:rommapp/romm@5.4.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "rommapp/romm 5.3.1 (romm)", - "summary": "0 [security] by @renovate [bot] in #4966" + "redis|GHSA-m8fj-85cg-7vhp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Lua library commands may lead to integer overflow and potential RCE" + }, + "redis|GHSA-prpq-rh5h-46g9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Denial-of-service due to malformed ACL selectors" + }, + "redis|GHSA-qrv7-wcrx-q5jp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Running Lua function as a different user" + }, + "redis|GHSA-r67f-p999-2gff": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client" + }, + "redis|GHSA-rp2m-q4j6-gr43": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Out of bounds write in hyperloglog commands leads to RCE" + }, + "redis|release:redis/redis@8.10.3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Update urgency: SECURITY: There is a security fix in the release" + }, + "rommapp/romm|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "rommapp/romm|release:rommapp/romm@5.4.1": { "first": "2026-10-26", @@ -1232,412 +2022,19 @@ "program": "rommapp/romm 5.3.1 (romm)", "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible" }, - "traefik|GHSA-28hp-c82p-8vqj": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret" - }, - "traefik|GHSA-53qr-784g-cj35": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients" - }, - "traefik|GHSA-cw35-4q88-3rmp": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another" - }, - "traefik|GHSA-fh26-gfpp-7xxx": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)" - }, - "traefik|GHSA-hrpp-p4fc-wwf8": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients" - }, - "traefik|GHSA-mhjw-hmjv-p99x": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams" - }, - "traefik|GHSA-mwrr-6hp4-pxr6": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route" - }, - "traefik|GHSA-p8wx-ph99-xgcr": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation" - }, - "traefik|GHSA-qm9f-w54v-q2qh": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool" - }, - "traefik|GHSA-qvj7-gq9c-hp7q": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth" - }, - "traefik|GHSA-rv2h-qh7j-xrjw": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA" - }, - "traefik|GHSA-ww7c-q3mv-xx22": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process" - }, - "traefik|release:traefik/traefik@v3.7.14": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Advisory GHSA-53qr-784g-cj35" - }, - "traefik|release:traefik/traefik@v3.7.15": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Advisory GHSA-p8wx-ph99-xgcr" - }, - "traefik|release:traefik/traefik@v3.7.16": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "traefik v3.7.13 (controller infra)", - "summary": "Advisory GHSA-hrpp-p4fc-wwf8" - }, - "vikunja/vikunja|GHSA-2f75-93c9-xf32": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Stored rich-text images make viewers' clients probe loopback and LAN addresses" - }, - "vikunja/vikunja|GHSA-3x3m-2j93-w46j": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Unbounded avatar size cache exhausts server memory" - }, - "vikunja/vikunja|GHSA-49pj-52x6-8gpj": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "No brute-force limit on password re-authentication; TOTP can be disabled with the password alone" - }, - "vikunja/vikunja|GHSA-4hv6-xc92-j86g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes" - }, - "vikunja/vikunja|GHSA-4qvp-948j-4cgv": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Revoked session's access token keeps working and can mint new credentials" - }, - "vikunja/vikunja|GHSA-586f-48mj-3rwr": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Read-only project members see credential-bearing webhook URLs" - }, - "vikunja/vikunja|GHSA-5f6v-j6xm-wwj9": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Project-webhook token scope reaches user-level webhooks" - }, - "vikunja/vikunja|GHSA-5fc2-w2j4-6r8w": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Bot API tokens keep working after the bot owner's account is disabled or locked" - }, - "vikunja/vikunja|GHSA-5q33-h98p-rgh9": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Webhook task payloads bypass read authorization via a no-op kanban bucket move" - }, - "vikunja/vikunja|GHSA-66cq-j6rw-pjch": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Webhook payloads leak related tasks from projects the webhook owner can't read" - }, - "vikunja/vikunja|GHSA-7f23-p76f-cx74": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Unbounded resize output in task-attachment image preview enables in-process API OOM (unfixed sibling of CVE-2026-91971)" - }, - "vikunja/vikunja|GHSA-7gmh-4fw6-8xc5": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Export archives are orphaned on disk and never cleaned up" - }, - "vikunja/vikunja|GHSA-9hxw-pxcq-4q8q": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Image decodes have no concurrency bound" - }, - "vikunja/vikunja|GHSA-9rfw-7hv4-3vv3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Local file storage blobs and SQLite database are world-readable" - }, - "vikunja/vikunja|GHSA-9xh7-5jg8-mf43": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Bucket delete uses the URL view instead of the bucket's real view" - }, - "vikunja/vikunja|GHSA-c934-xjq2-mrg3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "CalDAV VTODO RELATED-TO entries fan out into unbounded dummy tasks" - }, - "vikunja/vikunja|GHSA-ff52-3296-2fvr": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Link-share hash logged in the request path" - }, - "vikunja/vikunja|GHSA-fjrf-gjmg-9v6g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Team members cannot be removed after a client writes `external_id`" - }, - "vikunja/vikunja|GHSA-fmmf-xq98-g327": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Write-level project members can delete admin-tier link shares through an unloaded permission check" - }, - "vikunja/vikunja|GHSA-fprf-r6rv-xg99": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Saved filter creation with an empty filter string recalculates task positions across all tenants" - }, - "vikunja/vikunja|GHSA-frf4-3prf-3vch": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Login CSRF via form-encoded login and OIDC callback on /api/v2" - }, - "vikunja/vikunja|GHSA-g2xc-jv9q-46wq": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "WeKan and vikunja-file imports have no item-count cap, enabling in-process API OOM (unfixed variant of CVE-2026-91969)" - }, - "vikunja/vikunja|GHSA-h4q3-mc9r-q7vv": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "TOTP can be enrolled and enabled without the password, letting a stolen session lock the owner out" - }, - "vikunja/vikunja|GHSA-h8wj-3gwg-jjjg": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Release toolchain (xgo) pulled by mutable ref" - }, - "vikunja/vikunja|GHSA-hjx8-qv73-f7cm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed" - }, - "vikunja/vikunja|GHSA-hm4w-h7v8-ch43": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Nil bucket filter makes project view reads panic" - }, - "vikunja/vikunja|GHSA-hq66-9qg8-jwqg": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Account deletion escalates read-only shares to project admin or owner" - }, - "vikunja/vikunja|GHSA-hrw2-p27j-8mj8": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Plugin and log directories not re-anchored to the rootpath" - }, - "vikunja/vikunja|GHSA-j5v7-qcwp-5g32": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "API token scopes collide between v1 and v2, granting a different verb than intended" - }, - "vikunja/vikunja|GHSA-m687-p538-r5hp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted" - }, - "vikunja/vikunja|GHSA-mqq8-869v-48q8": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Vikunja-file ZIP import has no entry-count cap" - }, - "vikunja/vikunja|GHSA-p23m-cq25-pc4j": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Stored CSS injection in rich-text (TipTap) renderer via table-cell data-background-color" - }, - "vikunja/vikunja|GHSA-p697-wq4x-grpj": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Unbounded bucket count causes per-bucket query fan-out on kanban reads" - }, - "vikunja/vikunja|GHSA-pjr3-86v4-5p7w": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regressi" - }, - "vikunja/vikunja|GHSA-qf5p-grf5-wcq4": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Password-reset, email-confirm and account-deletion tokens in the URL query reach access logs" - }, - "vikunja/vikunja|GHSA-rj93-wmch-2crq": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Changing the API URL sends stored auth tokens to the new origin" - }, - "vikunja/vikunja|GHSA-rp33-8f2m-hm6j": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "HTML injection in conversational notification email headers via unescaped doer name and task/project titles (incomplete fix of GHSA-45q4-x4r9-8fqj)" - }, - "vikunja/vikunja|GHSA-rp64-xg8g-9mpr": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Dump archive is created with umask permissions" - }, - "vikunja/vikunja|GHSA-v3r6-33v3-79c2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Team self-removal endpoint reveals whether a private team exists" - }, - "vikunja/vikunja|GHSA-v579-5fwc-gr28": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "page=0 on v1 list endpoints returns the whole result set, bypassing service.maxitemsperpage" - }, - "vikunja/vikunja|GHSA-w64q-7p4m-j8g8": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Kanban task-bucket move lets a user put a task into another project's bucket" - }, - "vikunja/vikunja|GHSA-wqjr-22r7-5437": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Trello, Todoist and Microsoft To Do migrations buffer remote downloads and API responses without limits, enabling in-process API OOM" - }, - "vikunja/vikunja|GHSA-xgw3-ccqg-f6ww": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "silent": "first read after the seed", - "summary": "Migration OAuth callbacks are not bound to the initiating user" - }, - "vikunja/vikunja|release:go-vikunja/vikunja@v2.7.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "summary": "🔒 Six security fixes" - }, - "vikunja/vikunja|release:go-vikunja/vikunja@v2.7.1": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "vikunja/vikunja 2.6.0 (vikunja)", - "summary": "🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes" + "vabene1111/recipes|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" } }, "failures": { "registry:docker.io": { + "mailed": true, + "streak": 2 + }, + "runtime": { "mailed": false, "streak": 1 } @@ -2516,17 +2913,6 @@ "python": null, "unchecked": [] }, - "sha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:4876fdea29cac1a33a3195f1eb1952feb1fca7dd6dd00be3e2f1879cf20d34d2", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2622,17 +3008,6 @@ "python": null, "unchecked": [] }, - "sha256:76f0358884cb92d9a086d24e5671c38048d3fef40f2588703d73eb55392d6b69": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:2068651a18ac6048578647ea57b940ca2daed3f504ebe7fba6a93beeb39aaa1f", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:7837f8148cc6db5e3e9a8df199912950adaee66898ebad4949d9dbb2f30aa02b": { "apk": {}, "brotli": null, @@ -2785,6 +3160,17 @@ "python": null, "unchecked": [] }, + "sha256:89c1ea91e897f0fe0a3731595330bc45b8bdef4047464a07116f891a94054b31": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1e1a22175fbf1b32157ddaf0219e1db4e5401fab2b94ed285add64d18587cd2d", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:8a0ef97527544baa2b35825940ddf4db6e2d09c30cd5aa31fd269ff604cc8b75": { "apk": {}, "brotli": null, @@ -2967,6 +3353,17 @@ "python": null, "unchecked": [] }, + "sha256:a0225d1ea6631c8bc2385dc4c2faba17bbf1834ecf369e1659a9a382bd8d5dd7": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:5cf1e1293ea42e077e6a22114e6773b9aae3bb8f9933a2acd5a9721518ff8f5b", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:a0b71c8e757298d02560186bab9fbe3fc2d375c523a62cc1019177b37e48aa28": { "apk": {}, "brotli": null,