admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-watch: memory of 2026-11-08 (R-1303). Docs only.

Browse Source
This commit is contained in:
felhom security watch committed 2026-11-08 03:41:13 +00:00
1 parent 6f293aa151
commit a0d8057634
1 file changed
+105 -15
Download Patch File Download Diff File Expand all files Collapse all files
documentation/security-watch/state.json
+105 -15
View File
@@ -1326,6 +1326,48 @@
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Fix: various security fixes ( #38406 ) ( #38426 )"
},
"dooplex:glanceapp/glance|GHSA-294x-cjq2-6j5r": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "Both page handlers check whether a requested page slug exists **before** they run the authentication check. An unauthenticated attacker can therefore tell real "
},
"dooplex:glanceapp/glance|GHSA-3jjj-q8fg-pmrq": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "Denial of service in the Glance RSS widget: unbounded feed read + quadratic HTML parsing in bundled `golang.org/x/net` (CVE-2026-78661 / GO-2026-6860)"
},
"dooplex:glanceapp/glance|GHSA-8gc9-3vgm-hfr8": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "Stored XSS via glance.url Docker label (safeURL bypasses html/template scheme filtering)"
},
"dooplex:glanceapp/glance|GHSA-96x7-3hwp-rcfc": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "An attacker-controlled extension endpoint can store a `javascript:` URL in the Glance dashboard by returning it in the `Widget-Title-URL` response header. Glanc"
},
"dooplex:glanceapp/glance|GHSA-f2c4-p935-ffpj": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "Stored XSS via extension widget Widget-Title-URL header (safeURL scheme-filter bypass)"
},
"dooplex:glanceapp/glance|GHSA-v6q6-26vr-8rc9": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "When no `video-url-template` is configured, the `videos` widget uses the feed entry's `<link href>` value verbatim as the video card link and renders it with `s"
},
"dooplex:glanceapp/glance|release:glanceapp/glance@v0.8.8": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
"summary": "Fixed vulnerabilities"
},
"dooplex:grafana/grafana|GHSA-2x6g-h2hg-rq84": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1374,7 +1416,7 @@
},
"dooplex:louislam/uptime-kuma|GHSA-86ch-2247-gr56": {
"first": "2026-11-01",
"last_mailed": "2026-11-01",
"last_mailed": "2026-11-08",
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "Unauthenticated Host-header injection and RSS cache poisoning"
},
@@ -1647,6 +1689,12 @@
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
"summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
},
"freikin/dawarich|GHSA-f3w6-w445-fwh9": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "freikin/dawarich 1.19.0 (dawarich)",
"summary": "1 to close the security advisories fixed in that release, including GHSA-f3w6-w445-fwh9 (arbitrary file read and write in Active Storage image analysis)"
},
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
@@ -1705,6 +1753,36 @@
"silent": "first read after the seed",
"summary": "SSRF via HTTP Redirect in Repository Migration"
},
"glanceapp/glance|GHSA-294x-cjq2-6j5r": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "Both page handlers check whether a requested page slug exists **before** they run the authentication check. An unauthenticated attacker can therefore tell real "
},
"glanceapp/glance|GHSA-3jjj-q8fg-pmrq": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "Denial of service in the Glance RSS widget: unbounded feed read + quadratic HTML parsing in bundled `golang.org/x/net` (CVE-2026-78661 / GO-2026-6860)"
},
"glanceapp/glance|GHSA-8gc9-3vgm-hfr8": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "Stored XSS via glance.url Docker label (safeURL bypasses html/template scheme filtering)"
},
"glanceapp/glance|GHSA-96x7-3hwp-rcfc": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "An attacker-controlled extension endpoint can store a `javascript:` URL in the Glance dashboard by returning it in the `Widget-Title-URL` response header. Glanc"
},
"glanceapp/glance|GHSA-f2c4-p935-ffpj": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "Stored XSS via extension widget Widget-Title-URL header (safeURL scheme-filter bypass)"
},
"glanceapp/glance|GHSA-r225-jhr6-68cc": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1712,6 +1790,18 @@
"silent": "first read after the seed",
"summary": "Unauthenticated login requests can cause unbounded memory consumption"
},
"glanceapp/glance|GHSA-v6q6-26vr-8rc9": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "When no `video-url-template` is configured, the `videos` widget uses the feed entry's `<link href>` value verbatim as the video card link and renders it with `s"
},
"glanceapp/glance|release:glanceapp/glance@v0.8.8": {
"first": "2026-11-08",
"last_mailed": "2026-11-08",
"program": "glanceapp/glance v0.8.5 (glance)",
"summary": "Fixed vulnerabilities"
},
"grafana/grafana|GHSA-2x6g-h2hg-rq84": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1814,7 +1904,7 @@
},
"gtstef/filebrowser|GHSA-892f-9h5p-mfc8": {
"first": "2026-11-01",
"last_mailed": "2026-11-01",
"last_mailed": "2026-11-08",
"program": "gtstef/filebrowser 1.5.8-stable (controller infra)",
"summary": "Sensitive Data Exposure via /api/settings"
},
@@ -2614,19 +2704,6 @@
"python": null,
"unchecked": []
},
"sha256:3b8c947d7fa173f70e40047d2c8d02835fb8416aeb5ae36def57d9ad15e2f906": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:7c88dcb802a230f6f1f94dbb6a10a04d39a2db3971c798e1c5d165913374840b",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
"apk": {},
"brotli": null,
@@ -2889,6 +2966,19 @@
"python": null,
"unchecked": []
},
"sha256:673dc4609a5672bc8e46069c86ffcea283a86b48d34a6c93d8da8c24a1b87571": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:b5f192993722f6e97b561c3ee3536cf42190db770db30e2723cc1117da093374",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894": {
"apk": {
"brotli-libs": "1.2.0-r1"