From a560e699546780211ced169af0f0a792d71955a2 Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Mon, 2 Nov 2026 21:59:33 +0000 Subject: [PATCH] security-watch: memory of 2026-11-02 (R-1303). Docs only. --- documentation/security-watch/state.json | 118 +++++++++++++----------- 1 file changed, 63 insertions(+), 55 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index 3b1027b3..7a138935 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -6,6 +6,12 @@ "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, + "actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "actualbudget/actual-server 26.9.0 (actualbudget)", + "summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection" + }, "calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -98,6 +104,12 @@ "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, + "dooplex:actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", + "summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection" + }, "dooplex:advplyr/audiobookshelf|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -158,12 +170,6 @@ "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" }, - "dooplex:flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": { - "first": "2026-10-26", - "last_mailed": "2026-11-02", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" - }, "dooplex:flomp/wanderer-web|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -194,11 +200,17 @@ "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" }, - "dooplex:flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": { - "first": "2026-10-26", + "dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": { + "first": "2026-11-02", "last_mailed": "2026-11-02", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" + "program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)", + "summary": "1 introduces important security fixes" + }, + "dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)", + "summary": "1 introduces important security fixes" }, "dooplex:ghcr.io/gethomepage/homepage|CVE-2026-111497": { "first": "2026-10-28", @@ -1226,13 +1238,6 @@ "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only tokens expose private repositories through profile and organization tabs" }, - "dooplex:gitea/gitea|GHSA-x4q3-gcj3-m6cf": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled" - }, "dooplex:gitea/gitea|GHSA-x58h-3mx5-q44r": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1367,24 +1372,18 @@ "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, + "dooplex:louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", + "summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)" + }, "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { "first": "2026-10-26", "last_mailed": "2026-11-02", "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, - "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": { - "first": "2026-10-26", - "last_mailed": "2026-11-02", - "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", - "summary": "⬆️ Security Fixes" - }, - "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.9": { - "first": "2026-11-01", - "last_mailed": "2026-11-01", - "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", - "summary": "⬆️ Security Fixes" - }, "dooplex:outlinewiki/outline|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -1522,11 +1521,17 @@ "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "dooplex:vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": { + "dooplex:vaultwarden/server|GHSA-9pjj-f9g5-3x4c": { "first": "2026-11-02", "last_mailed": "2026-11-02", "program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)", - "summary": "Security Fixes" + "summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4" + }, + "dooplex:vaultwarden/server|GHSA-x9cq-f669-vrr4": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)", + "summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5" }, "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": { "first": "2026-10-28", @@ -1630,6 +1635,18 @@ "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo" }, + "getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "getmeili/meilisearch v1.36.0 (wanderer)", + "summary": "1 introduces important security fixes" + }, + "getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "getmeili/meilisearch v1.36.0 (wanderer)", + "summary": "1 introduces important security fixes" + }, "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -2109,17 +2126,11 @@ "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, - "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": { - "first": "2026-10-26", + "louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": { + "first": "2026-11-02", "last_mailed": "2026-11-02", - "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", - "summary": "⬆️ Security Fixes" - }, - "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.9": { - "first": "2026-11-01", - "last_mailed": "2026-11-01", "program": "louislam/uptime-kuma 2.5.7 (uptime-kuma)", - "summary": "⬆️ Security Fixes" + "summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)" }, "n8nio/n8n|GHSA-2x68-96jw-5r6c": { "first": "2026-10-29", @@ -2218,29 +2229,26 @@ "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "traefik|release:traefik/traefik@v3.7.17": { - "first": "2026-10-31", - "last_mailed": "2026-10-31", + "traefik|GHSA-xv5x-242w-7hf7": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", "program": "traefik v3.7.16 (controller infra)", - "summary": "[security] Point security announcements to GitHub advisories ( #14099 @nmengin )" + "summary": "Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)" }, - "vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": { + "vaultwarden/server|GHSA-9pjj-f9g5-3x4c": { "first": "2026-11-02", "last_mailed": "2026-11-02", "program": "vaultwarden/server 1.37.4-alpine (vaultwarden)", - "summary": "Security Fixes" - } - }, - "failures": { - "registry:docker.io": { - "mailed": true, - "streak": 7 + "summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4" }, - "runtime": { - "mailed": true, - "streak": 6 + "vaultwarden/server|GHSA-x9cq-f669-vrr4": { + "first": "2026-11-02", + "last_mailed": "2026-11-02", + "program": "vaultwarden/server 1.37.4-alpine (vaultwarden)", + "summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5" } }, + "failures": {}, "runtime_cache": { "sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f": { "apk": {},