diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json
index 22f7bb3d..449184fc 100644
--- a/documentation/security-watch/state.json
+++ b/documentation/security-watch/state.json
@@ -1326,6 +1326,48 @@
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Fix: various security fixes ( #38406 ) ( #38426 )"
},
+ "dooplex:glanceapp/glance|GHSA-294x-cjq2-6j5r": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "Both page handlers check whether a requested page slug exists **before** they run the authentication check. An unauthenticated attacker can therefore tell real "
+ },
+ "dooplex:glanceapp/glance|GHSA-3jjj-q8fg-pmrq": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "Denial of service in the Glance RSS widget: unbounded feed read + quadratic HTML parsing in bundled `golang.org/x/net` (CVE-2026-78661 / GO-2026-6860)"
+ },
+ "dooplex:glanceapp/glance|GHSA-8gc9-3vgm-hfr8": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "Stored XSS via glance.url Docker label (safeURL bypasses html/template scheme filtering)"
+ },
+ "dooplex:glanceapp/glance|GHSA-96x7-3hwp-rcfc": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "An attacker-controlled extension endpoint can store a `javascript:` URL in the Glance dashboard by returning it in the `Widget-Title-URL` response header. Glanc"
+ },
+ "dooplex:glanceapp/glance|GHSA-f2c4-p935-ffpj": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "Stored XSS via extension widget Widget-Title-URL header (safeURL scheme-filter bypass)"
+ },
+ "dooplex:glanceapp/glance|GHSA-v6q6-26vr-8rc9": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "When no `video-url-template` is configured, the `videos` widget uses the feed entry's `` value verbatim as the video card link and renders it with `s"
+ },
+ "dooplex:glanceapp/glance|release:glanceapp/glance@v0.8.8": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.7 (glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml)",
+ "summary": "Fixed vulnerabilities"
+ },
"dooplex:grafana/grafana|GHSA-2x6g-h2hg-rq84": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1374,7 +1416,7 @@
},
"dooplex:louislam/uptime-kuma|GHSA-86ch-2247-gr56": {
"first": "2026-11-01",
- "last_mailed": "2026-11-01",
+ "last_mailed": "2026-11-08",
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "Unauthenticated Host-header injection and RSS cache poisoning"
},
@@ -1647,6 +1689,12 @@
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
"summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
},
+ "freikin/dawarich|GHSA-f3w6-w445-fwh9": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "freikin/dawarich 1.19.0 (dawarich)",
+ "summary": "1 to close the security advisories fixed in that release, including GHSA-f3w6-w445-fwh9 (arbitrary file read and write in Active Storage image analysis)"
+ },
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
@@ -1705,6 +1753,36 @@
"silent": "first read after the seed",
"summary": "SSRF via HTTP Redirect in Repository Migration"
},
+ "glanceapp/glance|GHSA-294x-cjq2-6j5r": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "Both page handlers check whether a requested page slug exists **before** they run the authentication check. An unauthenticated attacker can therefore tell real "
+ },
+ "glanceapp/glance|GHSA-3jjj-q8fg-pmrq": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "Denial of service in the Glance RSS widget: unbounded feed read + quadratic HTML parsing in bundled `golang.org/x/net` (CVE-2026-78661 / GO-2026-6860)"
+ },
+ "glanceapp/glance|GHSA-8gc9-3vgm-hfr8": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "Stored XSS via glance.url Docker label (safeURL bypasses html/template scheme filtering)"
+ },
+ "glanceapp/glance|GHSA-96x7-3hwp-rcfc": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "An attacker-controlled extension endpoint can store a `javascript:` URL in the Glance dashboard by returning it in the `Widget-Title-URL` response header. Glanc"
+ },
+ "glanceapp/glance|GHSA-f2c4-p935-ffpj": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "Stored XSS via extension widget Widget-Title-URL header (safeURL scheme-filter bypass)"
+ },
"glanceapp/glance|GHSA-r225-jhr6-68cc": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1712,6 +1790,18 @@
"silent": "first read after the seed",
"summary": "Unauthenticated login requests can cause unbounded memory consumption"
},
+ "glanceapp/glance|GHSA-v6q6-26vr-8rc9": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "When no `video-url-template` is configured, the `videos` widget uses the feed entry's `` value verbatim as the video card link and renders it with `s"
+ },
+ "glanceapp/glance|release:glanceapp/glance@v0.8.8": {
+ "first": "2026-11-08",
+ "last_mailed": "2026-11-08",
+ "program": "glanceapp/glance v0.8.5 (glance)",
+ "summary": "Fixed vulnerabilities"
+ },
"grafana/grafana|GHSA-2x6g-h2hg-rq84": {
"first": "2026-10-27",
"last_mailed": "2026-11-03",
@@ -1814,7 +1904,7 @@
},
"gtstef/filebrowser|GHSA-892f-9h5p-mfc8": {
"first": "2026-11-01",
- "last_mailed": "2026-11-01",
+ "last_mailed": "2026-11-08",
"program": "gtstef/filebrowser 1.5.8-stable (controller infra)",
"summary": "Sensitive Data Exposure via /api/settings"
},
@@ -2614,19 +2704,6 @@
"python": null,
"unchecked": []
},
- "sha256:3b8c947d7fa173f70e40047d2c8d02835fb8416aeb5ae36def57d9ad15e2f906": {
- "apk": {
- "brotli-libs": "1.2.1-r0"
- },
- "brotli": null,
- "brotlicffi": null,
- "digest": "sha256:7c88dcb802a230f6f1f94dbb6a10a04d39a2db3971c798e1c5d165913374840b",
- "dpkg": {},
- "env": {},
- "node": null,
- "python": null,
- "unchecked": []
- },
"sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
"apk": {},
"brotli": null,
@@ -2889,6 +2966,19 @@
"python": null,
"unchecked": []
},
+ "sha256:673dc4609a5672bc8e46069c86ffcea283a86b48d34a6c93d8da8c24a1b87571": {
+ "apk": {
+ "brotli-libs": "1.2.1-r0"
+ },
+ "brotli": null,
+ "brotlicffi": null,
+ "digest": "sha256:b5f192993722f6e97b561c3ee3536cf42190db770db30e2723cc1117da093374",
+ "dpkg": {},
+ "env": {},
+ "node": null,
+ "python": null,
+ "unchecked": []
+ },
"sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894": {
"apk": {
"brotli-libs": "1.2.0-r1"