admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-watch: memory of 2026-11-02 (R-1303). Docs only.

Browse Source
This commit is contained in:
felhom security watch committed 2026-11-02 21:59:33 +00:00
1 parent 4afa8c3cde
commit a560e69954
1 file changed
+63 -55
Download Patch File Download Diff File Expand all files Collapse all files
documentation/security-watch/state.json
+63 -55
View File
@@ -6,6 +6,12 @@
"program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)",
"summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
},
"actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "actualbudget/actual-server 26.9.0 (actualbudget)",
"summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection"
},
"calcom/cal.com|CVE-2026-111497": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -98,6 +104,12 @@
"program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)",
"summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
},
"dooplex:actualbudget/actual-server|GHSA-p7p2-pm6f-rg6x": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)",
"summary": "Electron enableNodeOptionsEnvironmentVariable fuse re-enabled allows NODE_OPTIONS code injection"
},
"dooplex:advplyr/audiobookshelf|CVE-2026-111497": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -158,12 +170,6 @@
"program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)",
"summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
},
"dooplex:flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
},
"dooplex:flomp/wanderer-web|CVE-2026-111497": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -194,11 +200,17 @@
"program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)",
"summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
},
"dooplex:flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
"first": "2026-10-26",
"dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
"program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)",
"summary": "1 introduces important security fixes"
},
"dooplex:getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "getmeili/meilisearch v1.11.3 (wanderer-system/wanderer.yaml)",
"summary": "1 introduces important security fixes"
},
"dooplex:ghcr.io/gethomepage/homepage|CVE-2026-111497": {
"first": "2026-10-28",
@@ -1226,13 +1238,6 @@
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
"summary": "Public-only tokens expose private repositories through profile and organization tabs"
},
"dooplex:gitea/gitea|GHSA-x4q3-gcj3-m6cf": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"
},
"dooplex:gitea/gitea|GHSA-x58h-3mx5-q44r": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -1367,24 +1372,18 @@
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
},
"dooplex:louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)"
},
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
"first": "2026-10-26",
"last_mailed": "2026-11-02",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.9": {
"first": "2026-11-01",
"last_mailed": "2026-11-01",
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "⬆️ Security Fixes"
},
"dooplex:outlinewiki/outline|CVE-2026-111497": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -1522,11 +1521,17 @@
"program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)",
"summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
},
"dooplex:vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": {
"dooplex:vaultwarden/server|GHSA-9pjj-f9g5-3x4c": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)",
"summary": "Security Fixes"
"summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4"
},
"dooplex:vaultwarden/server|GHSA-x9cq-f669-vrr4": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)",
"summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5"
},
"f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
"first": "2026-10-28",
@@ -1630,6 +1635,18 @@
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
"summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
},
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.55.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "getmeili/meilisearch v1.36.0 (wanderer)",
"summary": "1 introduces important security fixes"
},
"getmeili/meilisearch|release:meilisearch/meilisearch@v1.56.1": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "getmeili/meilisearch v1.36.0 (wanderer)",
"summary": "1 introduces important security fixes"
},
"ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": {
"first": "2026-10-28",
"last_mailed": "2026-10-28",
@@ -2109,17 +2126,11 @@
"program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)",
"summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
},
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
"first": "2026-10-26",
"louislam/uptime-kuma|GHSA-v2p3-6f5h-6hhf": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.9": {
"first": "2026-11-01",
"last_mailed": "2026-11-01",
"program": "louislam/uptime-kuma 2.5.7 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
"summary": "Authenticated RCE via Apprise CLI Argument Injection (Missing -- Separator)"
},
"n8nio/n8n|GHSA-2x68-96jw-5r6c": {
"first": "2026-10-29",
@@ -2218,29 +2229,26 @@
"program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)",
"summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
},
"traefik|release:traefik/traefik@v3.7.17": {
"first": "2026-10-31",
"last_mailed": "2026-10-31",
"traefik|GHSA-xv5x-242w-7hf7": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "traefik v3.7.16 (controller infra)",
"summary": "[security] Point security announcements to GitHub advisories ( #14099 @nmengin )"
"summary": "Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)"
},
"vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": {
"vaultwarden/server|GHSA-9pjj-f9g5-3x4c": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "vaultwarden/server 1.37.4-alpine (vaultwarden)",
"summary": "Security Fixes"
}
},
"failures": {
"registry:docker.io": {
"mailed": true,
"streak": 7
"summary": "Emergency access [GHSA-9pjj-f9g5-3x4c] ( Medium , 4"
},
"runtime": {
"mailed": true,
"streak": 6
"vaultwarden/server|GHSA-x9cq-f669-vrr4": {
"first": "2026-11-02",
"last_mailed": "2026-11-02",
"program": "vaultwarden/server 1.37.4-alpine (vaultwarden)",
"summary": "Website icons [GHSA-x9cq-f669-vrr4] ( Medium , 5"
}
},
"failures": {},
"runtime_cache": {
"sha256:01bdf0ad6d53198da4331540c1e73ab65db7a72e961fff97ecb0847d46055c5f": {
"apk": {},