security-watch: memory of 2026-11-02 (R-1303). Docs only.
This commit is contained in:
felhom security watch committed
1 parent
f196e74e60
commit
c25b790ce9
1 file changed
+325
-73
@@ -160,7 +160,7 @@
|
||||
},
|
||||
"dooplex:flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||||
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
|
||||
},
|
||||
@@ -196,7 +196,7 @@
|
||||
},
|
||||
"dooplex:flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||||
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
|
||||
},
|
||||
@@ -405,12 +405,30 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-32h8-5xqg-h466": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Actions: fork workflow gets secrets and write token via review commit_id"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-36q5-5423-vgx2": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-37xv-m4w7-j2fh": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Public-only tokens bypass private-resource restrictions on the admin API"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-3fv3-hhmm-4x2q": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-3pww-vcvm-3gmj": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -500,6 +518,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Local File Inclusion via file:// URI in Migration Restore"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-5j4v-rwqr-vpq7": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-5w72-2mqm-qh46": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -556,6 +580,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-6h2f-c8jm-84hc": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-6hm7-3pwj-22rm": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -614,6 +644,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8g99-g36h-5p2w": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Public-only package tokens can access private OCI blobs"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8hhh-mqpg-jpxc": {
|
||||
"first": "2026-10-27",
|
||||
"last_mailed": "2026-10-27",
|
||||
@@ -628,6 +664,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Draft releases include attachment metadata from other repositories"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8p3x-w464-4g6v": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8p9h-49rc-qgxj": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -641,6 +683,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8r36-6j2c-3gmv": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-8r3w-5682-jrqf": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -711,6 +759,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-9v6p-xpcp-7488": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-c3cr-qq9g-666c": {
|
||||
"first": "2026-10-27",
|
||||
"last_mailed": "2026-10-27",
|
||||
@@ -718,6 +772,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-c45m-jm46-mwxg": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Public project boards disclose private pull request titles and repository names"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-cp3q-vrj2-ghhh": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -881,6 +941,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "REST API exposes organization membership of private organizations to public"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-jr76-w9m3-3p68": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds "
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-m6qc-j894-7h9r": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -912,6 +978,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Cross-Session OpenID Credential Linking Enables Account Takeover"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-mf6p-vqpw-3r7x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Actions token can spoof instance-signed commits by adding a GPG key"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-mg4f-x9v4-6h2p": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -945,6 +1017,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Private Repository Existence Disclosure via go-get Meta Endpoint"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-p86q-78gw-8f3f": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-pgqf-926r-548m": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -988,12 +1066,30 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "User-scoped tokens can mint unscoped HTTP signature API credentials"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-q9gm-9c7q-c5hq": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-q9pg-jj6x-j9p6": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-qcgm-ggp8-22qc": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-r6mh-qg79-rqj2": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-r96c-jc75-rxv6": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -1056,6 +1152,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-vmrc-8q2x-573x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "API Issue Mutation Archive Restriction Bypass"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-vrhc-jjfc-m3m3": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -1118,6 +1220,12 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Locked issues and comments still accept reactions through the web UI"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-wxcq-p34j-7cjj": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Public-only tokens expose private repositories through profile and organization tabs"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-x4q3-gcj3-m6cf": {
|
||||
"first": "2026-10-27",
|
||||
"last_mailed": "2026-10-27",
|
||||
@@ -1131,6 +1239,12 @@
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Repository migration skips public-only token guard for private repository creation"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-x5v4-836g-f95x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)",
|
||||
"summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories"
|
||||
},
|
||||
"dooplex:gitea/gitea|GHSA-x77v-q46j-393g": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -1255,13 +1369,13 @@
|
||||
},
|
||||
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||||
"summary": "⬆️ Security Fixes"
|
||||
},
|
||||
"dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||||
"summary": "⬆️ Security Fixes"
|
||||
},
|
||||
@@ -1314,7 +1428,7 @@
|
||||
},
|
||||
"dooplex:outlinewiki/outline|release:outline/outline@v1.12.0": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "outlinewiki/outline 1.10.1 (outline)",
|
||||
"summary": "1 which fixes multiple recently disclosed vulnerabilities"
|
||||
},
|
||||
@@ -1398,7 +1512,7 @@
|
||||
},
|
||||
"dooplex:rommapp/romm|release:rommapp/romm@5.4.1": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "rommapp/romm 5.3.1 (romm)",
|
||||
"summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
|
||||
},
|
||||
@@ -1408,6 +1522,12 @@
|
||||
"program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)",
|
||||
"summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
|
||||
},
|
||||
"dooplex:vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "vaultwarden/server 1.37.4 (vaultwarden-system/vaultwarden.yaml)",
|
||||
"summary": "Security Fixes"
|
||||
},
|
||||
"f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
|
||||
"first": "2026-10-28",
|
||||
"last_mailed": "2026-10-28",
|
||||
@@ -1581,6 +1701,108 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints"
|
||||
},
|
||||
"gitea/gitea|GHSA-32h8-5xqg-h466": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Actions: fork workflow gets secrets and write token via review commit_id"
|
||||
},
|
||||
"gitea/gitea|GHSA-37xv-m4w7-j2fh": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public-only tokens bypass private-resource restrictions on the admin API"
|
||||
},
|
||||
"gitea/gitea|GHSA-3fv3-hhmm-4x2q": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-"
|
||||
},
|
||||
"gitea/gitea|GHSA-5j4v-rwqr-vpq7": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Gitea web profile and feed routes bypass public-only token scope for limited-visibility users"
|
||||
},
|
||||
"gitea/gitea|GHSA-6h2f-c8jm-84hc": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)"
|
||||
},
|
||||
"gitea/gitea|GHSA-8g99-g36h-5p2w": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public-only package tokens can access private OCI blobs"
|
||||
},
|
||||
"gitea/gitea|GHSA-8p3x-w464-4g6v": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username"
|
||||
},
|
||||
"gitea/gitea|GHSA-8r36-6j2c-3gmv": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos"
|
||||
},
|
||||
"gitea/gitea|GHSA-9v6p-xpcp-7488": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header"
|
||||
},
|
||||
"gitea/gitea|GHSA-c45m-jm46-mwxg": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public project boards disclose private pull request titles and repository names"
|
||||
},
|
||||
"gitea/gitea|GHSA-jh8p-x4ch-389q": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public-Only Token Bypass on Bulk Organization Repository Deletion"
|
||||
},
|
||||
"gitea/gitea|GHSA-jr76-w9m3-3p68": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds "
|
||||
},
|
||||
"gitea/gitea|GHSA-mf6p-vqpw-3r7x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Actions token can spoof instance-signed commits by adding a GPG key"
|
||||
},
|
||||
"gitea/gitea|GHSA-p86q-78gw-8f3f": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDep"
|
||||
},
|
||||
"gitea/gitea|GHSA-q9gm-9c7q-c5hq": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)"
|
||||
},
|
||||
"gitea/gitea|GHSA-qcgm-ggp8-22qc": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public-only PAT scope bypass via Actions runner registration leaks private repository secrets"
|
||||
},
|
||||
"gitea/gitea|GHSA-r6mh-qg79-rqj2": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)"
|
||||
},
|
||||
"gitea/gitea|GHSA-rqhx-647v-wx32": {
|
||||
"first": "2026-10-27",
|
||||
"last_mailed": "2026-10-27",
|
||||
@@ -1588,6 +1810,30 @@
|
||||
"silent": "first read after the seed",
|
||||
"summary": "SSRF via HTTP Redirect in Repository Migration"
|
||||
},
|
||||
"gitea/gitea|GHSA-vmrc-8q2x-573x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "API Issue Mutation Archive Restriction Bypass"
|
||||
},
|
||||
"gitea/gitea|GHSA-wxcq-p34j-7cjj": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Public-only tokens expose private repositories through profile and organization tabs"
|
||||
},
|
||||
"gitea/gitea|GHSA-x5v4-836g-f95x": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories"
|
||||
},
|
||||
"gitea/gitea|release:go-gitea/gitea@v28.3.0": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gitea/gitea 28.2.0 (gitea)",
|
||||
"summary": "0 [security] ( #40050 ) ( #40051 )"
|
||||
},
|
||||
"glanceapp/glance|GHSA-r225-jhr6-68cc": {
|
||||
"first": "2026-10-27",
|
||||
"last_mailed": "2026-10-27",
|
||||
@@ -1643,61 +1889,61 @@
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Moving or renaming a folder retargets public shares to the whole folder"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-4v62-884x-2466": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
|
||||
},
|
||||
@@ -1709,145 +1955,145 @@
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Logout Bypass via Alternate JWT Spelling"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Read-only users can overwrite files through PUT /api/resources"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-cw65-p35p-633w": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Custom API token with no global caps inherits owner admin access"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-p93p-v944-4p44": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-qv53-4557-m65h": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
|
||||
},
|
||||
"gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||||
"summary": "Share authorization gaps let read-only users delete files"
|
||||
},
|
||||
@@ -1865,7 +2111,7 @@
|
||||
},
|
||||
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
|
||||
"first": "2026-10-26",
|
||||
"last_mailed": "2026-10-26",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||||
"summary": "⬆️ Security Fixes"
|
||||
},
|
||||
@@ -1977,16 +2223,22 @@
|
||||
"last_mailed": "2026-10-31",
|
||||
"program": "traefik v3.7.16 (controller infra)",
|
||||
"summary": "[security] Point security announcements to GitHub advisories ( #14099 @nmengin )"
|
||||
},
|
||||
"vaultwarden/server|release:dani-garcia/vaultwarden@1.37.5": {
|
||||
"first": "2026-11-02",
|
||||
"last_mailed": "2026-11-02",
|
||||
"program": "vaultwarden/server 1.37.4-alpine (vaultwarden)",
|
||||
"summary": "Security Fixes"
|
||||
}
|
||||
},
|
||||
"failures": {
|
||||
"registry:docker.io": {
|
||||
"mailed": true,
|
||||
"streak": 6
|
||||
"streak": 7
|
||||
},
|
||||
"runtime": {
|
||||
"mailed": true,
|
||||
"streak": 5
|
||||
"streak": 6
|
||||
}
|
||||
},
|
||||
"runtime_cache": {
|
||||
@@ -2028,13 +2280,27 @@
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:084b3b2ab1d0ef930660727259546a241f2bdf67c9ed085d54bf1486a6887c9b": {
|
||||
"sha256:055a930b0c556f4114408b7c145087ef362c01991446f6e20ad164d4eb4d9f0d": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.1-r0"
|
||||
},
|
||||
"brotli": null,
|
||||
"brotlicffi": null,
|
||||
"digest": "sha256:41fdc1672209c2ef31c5260015ec8b96e3c75513e60a667eb052e1ff54b4cfa9",
|
||||
"digest": "sha256:3a6a9b1bf8404bbde5c7ff3bb79b5a28af2867198cc2fa0aa74eae9fe00281ba",
|
||||
"dpkg": {},
|
||||
"env": {},
|
||||
"node": null,
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:05c1454f9a32967affc1f34f67f8cc0cc57dd805dca45489fe797095a6286556": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.1-r0",
|
||||
"python3": "3.14.10-r1"
|
||||
},
|
||||
"brotli": null,
|
||||
"brotlicffi": null,
|
||||
"digest": "sha256:53b6b44f1c99fae7c823cf2cebebe75372f8080c95a31269491cc2672b474957",
|
||||
"dpkg": {},
|
||||
"env": {},
|
||||
"node": null,
|
||||
@@ -2816,19 +3082,6 @@
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:6282144f9a14d4a4dca2bc96801a2e43a2ff51116f001b13e5488eacad7b80e2": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.0-r1"
|
||||
},
|
||||
"brotli": null,
|
||||
"brotlicffi": null,
|
||||
"digest": "sha256:cb02c63fdc2dd9536ca9614d74f0a130b318c5813f76963570db1f782968c574",
|
||||
"dpkg": {},
|
||||
"env": {},
|
||||
"node": null,
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:68455d4953bad8e984e1bc5d112ed1e9c918a0a04f104c13c9ece50790308894": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.0-r1"
|
||||
@@ -2914,20 +3167,6 @@
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:75ecbb1c89ab7b0a21c4bde40b4820e4f1649d2d56d83b91913422155e8d2a5f": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.1-r0",
|
||||
"python3": "3.14.8-r0"
|
||||
},
|
||||
"brotli": null,
|
||||
"brotlicffi": null,
|
||||
"digest": "sha256:236a7a3a81a3706182ae1f12ee55aa3781c753963e680b2d9c8e55541686d0ce",
|
||||
"dpkg": {},
|
||||
"env": {},
|
||||
"node": null,
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:7837f8148cc6db5e3e9a8df199912950adaee66898ebad4949d9dbb2f30aa02b": {
|
||||
"apk": {},
|
||||
"brotli": null,
|
||||
@@ -3404,6 +3643,19 @@
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:ade5937813c6ae415b29db729386e53fea3ecf067a019849bafbe2d2a6ec02ba": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.2.1-r0"
|
||||
},
|
||||
"brotli": null,
|
||||
"brotlicffi": null,
|
||||
"digest": "sha256:6c8e1bca60c0100ebff5fef5c98d4a72255786b98ce4700440b4d2c52dad37d3",
|
||||
"dpkg": {},
|
||||
"env": {},
|
||||
"node": null,
|
||||
"python": null,
|
||||
"unchecked": []
|
||||
},
|
||||
"sha256:ae9094a0ead891eef80499a072e680734bcb34892242f0e232223c65eb4c3af8": {
|
||||
"apk": {
|
||||
"brotli-libs": "1.1.0-r1"
|
||||
@@ -4029,5 +4281,5 @@
|
||||
"seed_pending": [],
|
||||
"seeded_at": "2026-10-26",
|
||||
"version": 1,
|
||||
"weekly_last": "2026-10-26"
|
||||
"weekly_last": "2026-11-02"
|
||||
}
|
||||
Reference in new issue
Block a user