From e57d0c6171249d2b7a80e9e9f80876945edfe756 Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Wed, 4 Nov 2026 03:44:59 +0000 Subject: [PATCH] security-watch: memory of 2026-11-04 (R-1303). Docs only. --- documentation/security-watch/state.json | 662 ++++++++++-------------- 1 file changed, 279 insertions(+), 383 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index c7783e83..609a4c87 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -2,7 +2,7 @@ "advisories": { "calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "calcom/cal.com v6.2.0 (calcom)", "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" }, @@ -28,7 +28,7 @@ }, "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.5:VULN-183456": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "cloudflare/cloudflared 2026.10.4 (controller infra)", "summary": "- 2026-10-26 VULN-183456: Bump github.com/go-chi/chi/v5 to v5.5.0" }, @@ -40,55 +40,55 @@ }, "codewithcj/sparkyfitness_server|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts" }, "codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" }, "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)", "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno" }, "codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts" }, "codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state" }, "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)", "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno" }, "crocodilestick/calibre-web-automated|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)", "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, "dooplex:actualbudget/actual-server|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -100,13 +100,13 @@ }, "dooplex:advplyr/audiobookshelf|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "advplyr/audiobookshelf 2.37.1 (audiobookshelf-system/audiobookshelf.yaml)", "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "dooplex:codewithcj/sparkyfitness_server|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -124,67 +124,67 @@ }, "dooplex:crocodilestick/calibre-web-automated|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)", "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, "dooplex:docker.io/calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "docker.io/calcom/cal.com v6.2.0 (booking-system/booking.yaml)", "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" }, "dooplex:flomp/wanderer-db|GHSA-3xp7-7492-j2q6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" }, "dooplex:flomp/wanderer-db|GHSA-fprh-3pp9-68m9": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" }, "dooplex:flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" }, "dooplex:flomp/wanderer-db|GHSA-vprp-gr6m-j375": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" }, "dooplex:flomp/wanderer-web|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "dooplex:flomp/wanderer-web|GHSA-3xp7-7492-j2q6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" }, "dooplex:flomp/wanderer-web|GHSA-fprh-3pp9-68m9": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" }, "dooplex:flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" }, "dooplex:flomp/wanderer-web|GHSA-vprp-gr6m-j375": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" }, @@ -202,7 +202,7 @@ }, "dooplex:ghcr.io/gethomepage/homepage|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml)", "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -215,151 +215,151 @@ }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-3mh5-gqfm-phgj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-72rm-x7xr-v679": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-c9mf-h82r-8p4j": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-g4w3-c888-cr93": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-h5w4-vjv4-9r5q": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-hfvf-5c8x-8rc4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-hv27-723h-qfjq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-jrp5-g662-hq92": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-q89f-h332-8q2h": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" }, "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-qp2h-w794-2vhf": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" }, "dooplex:ghcr.io/immich-app/immich-server|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Node.js 24.14.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-3mh5-gqfm-phgj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-72rm-x7xr-v679": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-c9mf-h82r-8p4j": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-g4w3-c888-cr93": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-h5w4-vjv4-9r5q": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-hfvf-5c8x-8rc4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-hv27-723h-qfjq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-jrp5-g662-hq92": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-q89f-h332-8q2h": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" }, "dooplex:ghcr.io/immich-app/immich-server|GHSA-qp2h-w794-2vhf": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" }, "dooplex:ghcr.io/lukegus/termix|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/lukegus/termix release-2.9.2 (termix-system/termix.yaml)", "summary": "Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, "dooplex:ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)", "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, @@ -371,37 +371,37 @@ }, "dooplex:gitea/gitea|GHSA-25gq-j9jx-43pg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)" }, "dooplex:gitea/gitea|GHSA-2fcr-jfvc-vgg2": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Two SSRF findings in Gitea 1.26.2" }, "dooplex:gitea/gitea|GHSA-2m9v-5q2g-58vq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Git LFS object reuse allows non-Code access to authorize private source objects" }, "dooplex:gitea/gitea|GHSA-2r5c-gw76-rh3w": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter" }, "dooplex:gitea/gitea|GHSA-2wm4-vwp6-v7xc": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata" }, "dooplex:gitea/gitea|GHSA-2xph-7j4g-43rg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)" }, @@ -413,7 +413,7 @@ }, "dooplex:gitea/gitea|GHSA-36q5-5423-vgx2": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory" }, @@ -431,19 +431,19 @@ }, "dooplex:gitea/gitea|GHSA-3pww-vcvm-3gmj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data" }, "dooplex:gitea/gitea|GHSA-3r5c-2xxx-h872": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Webhook Authorization Header Returned in Plaintext via API" }, "dooplex:gitea/gitea|GHSA-44qc-pgvp-wx7v": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Notification API leaks private issue metadata after access revocation" }, @@ -463,13 +463,13 @@ }, "dooplex:gitea/gitea|GHSA-46c7-w5w4-h644": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Email Management API Bypasses ManageCredentials Feature Restrictions" }, "dooplex:gitea/gitea|GHSA-46px-6cqx-c5fv": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Authenticated DoS in OneDev migration via unbounded version response body" }, @@ -489,7 +489,7 @@ }, "dooplex:gitea/gitea|GHSA-4xjf-493q-98p3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea SSH Key Parser Denial of Service" }, @@ -502,19 +502,19 @@ }, "dooplex:gitea/gitea|GHSA-579w-82gf-89m2": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Remote Code Execution via unescaped markup `Context` into external renderer argv" }, "dooplex:gitea/gitea|GHSA-5952-x23q-p23f": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Authenticated DoS in GitLab migration via uncancelable version probe" }, "dooplex:gitea/gitea|GHSA-5ggr-2f2h-jmvm": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Local File Inclusion via file:// URI in Migration Restore" }, @@ -526,43 +526,43 @@ }, "dooplex:gitea/gitea|GHSA-5w72-2mqm-qh46": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Wiki-only members can read private pull request titles through markup preview" }, "dooplex:gitea/gitea|GHSA-5xcq-p92v-43rf": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Package size quota bypass and unbounded memory read in the Maven checksum upload path" }, "dooplex:gitea/gitea|GHSA-5xp7-r6cr-39ff": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request" }, "dooplex:gitea/gitea|GHSA-66m4-5jjr-2rg5": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocatio" }, "dooplex:gitea/gitea|GHSA-683j-3ff6-hh2x": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Privilege Escalation via Access Token Scope Escalation in API" }, "dooplex:gitea/gitea|GHSA-6c6r-5xr4-cr5m": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Cross-repository issue/comment attachment re-linking can expose private attachment content" }, "dooplex:gitea/gitea|GHSA-6cqf-375w-639g": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)" }, @@ -588,7 +588,7 @@ }, "dooplex:gitea/gitea|GHSA-6hm7-3pwj-22rm": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload" }, @@ -608,7 +608,7 @@ }, "dooplex:gitea/gitea|GHSA-777r-4v59-6486": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Permanent Fork PR Workflow Approval Gate Bypass" }, @@ -621,7 +621,7 @@ }, "dooplex:gitea/gitea|GHSA-7p4h-3gxq-x3h3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118" }, @@ -634,13 +634,13 @@ }, "dooplex:gitea/gitea|GHSA-7w2r-xwp6-mh6c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)" }, "dooplex:gitea/gitea|GHSA-7wvc-rvp7-w99x": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories" }, @@ -672,7 +672,7 @@ }, "dooplex:gitea/gitea|GHSA-8p9h-49rc-qgxj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repository Visibility Manipulation via Git Push Options" }, @@ -691,25 +691,25 @@ }, "dooplex:gitea/gitea|GHSA-8r3w-5682-jrqf": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unbounded gitignores repository-creation field enables linear template-read amplification" }, "dooplex:gitea/gitea|GHSA-8vmh-w35x-73qr": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unauthenticated Blind SSRF via OpenID Sign-In Verification" }, "dooplex:gitea/gitea|GHSA-8xjr-x7rg-hp5h": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "2FA bypass and persistent account takeover via OpenID identity linking" }, "dooplex:gitea/gitea|GHSA-92j2-6qcg-c28c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)" }, @@ -729,13 +729,13 @@ }, "dooplex:gitea/gitea|GHSA-94v3-77j7-vm48": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)" }, "dooplex:gitea/gitea|GHSA-96gv-2xc4-4hxj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade" }, @@ -755,7 +755,7 @@ }, "dooplex:gitea/gitea|GHSA-9mq6-mqjj-c2c5": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads" }, @@ -780,7 +780,7 @@ }, "dooplex:gitea/gitea|GHSA-cp3q-vrj2-ghhh": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents" }, @@ -793,25 +793,25 @@ }, "dooplex:gitea/gitea|GHSA-f75j-4cw6-rmx4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`" }, "dooplex:gitea/gitea|GHSA-f8ph-p9p5-vg2p": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unauthenticated artifact-to-repository oracle in raw Actions downloads" }, "dooplex:gitea/gitea|GHSA-fj8v-hjwv-qm88": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)" }, "dooplex:gitea/gitea|GHSA-fq2p-5p22-8g6j": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints" }, @@ -824,25 +824,25 @@ }, "dooplex:gitea/gitea|GHSA-fqxf-w92m-prvq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Swift registry per-file 128KiB manifest guard bypassed by aggregation" }, "dooplex:gitea/gitea|GHSA-frpv-2xgv-wxpq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in th" }, "dooplex:gitea/gitea|GHSA-frpw-3h2q-4jj6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs" }, "dooplex:gitea/gitea|GHSA-fw57-jgch-pgf3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests" }, @@ -862,31 +862,31 @@ }, "dooplex:gitea/gitea|GHSA-g5jj-gp8w-73h7": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess" }, "dooplex:gitea/gitea|GHSA-gx3v-q759-g323": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface" }, "dooplex:gitea/gitea|GHSA-h2x6-g7q6-344v": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repository migration SSRF via multi-answer DNS allow-list bypass" }, "dooplex:gitea/gitea|GHSA-h56g-4qw7-2mxg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only API token restriction is not enforced on team API routes" }, "dooplex:gitea/gitea|GHSA-h62v-wmrr-5qjq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Admin repository collaborator can self-escalate to Owner and transfer the repository" }, @@ -899,7 +899,7 @@ }, "dooplex:gitea/gitea|GHSA-hch4-r2j8-xm72": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate" }, @@ -912,19 +912,19 @@ }, "dooplex:gitea/gitea|GHSA-hxhc-246f-rvqc": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Organization repository creation endpoint skips repository token scope" }, "dooplex:gitea/gitea|GHSA-j2w3-9c3r-g83q": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Private Repository Metadata Remains Accessible After Access Revocation" }, "dooplex:gitea/gitea|GHSA-j72v-mjr6-3424": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)" }, @@ -937,7 +937,7 @@ }, "dooplex:gitea/gitea|GHSA-jr5x-6h83-wrxf": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "REST API exposes organization membership of private organizations to public" }, @@ -949,25 +949,25 @@ }, "dooplex:gitea/gitea|GHSA-m6qc-j894-7h9r": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting" }, "dooplex:gitea/gitea|GHSA-m78w-jjjx-gp8r": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)" }, "dooplex:gitea/gitea|GHSA-m932-crvm-gcp5": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service" }, "dooplex:gitea/gitea|GHSA-m984-2424-x6vw": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Generic attachment downloads bypass draft-release visibility checks" }, @@ -986,7 +986,7 @@ }, "dooplex:gitea/gitea|GHSA-mg4f-x9v4-6h2p": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes" }, @@ -1013,7 +1013,7 @@ }, "dooplex:gitea/gitea|GHSA-p4mj-98mv-xq26": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint" }, @@ -1025,19 +1025,19 @@ }, "dooplex:gitea/gitea|GHSA-pgqf-926r-548m": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API" }, "dooplex:gitea/gitea|GHSA-pq8x-xpgp-rvmh": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Permissive Git hook directory and script modes may allow local code execution as the Gitea service account" }, "dooplex:gitea/gitea|GHSA-prr9-9mp4-5gp2": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Private org member list leaked via /members API endpoint — incomplete fix for PR #38145" }, @@ -1050,19 +1050,19 @@ }, "dooplex:gitea/gitea|GHSA-px3q-x2mm-55wg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Package registry: restricted users can read packages of limited-visibility users (authorization bypass)" }, "dooplex:gitea/gitea|GHSA-q423-49rw-g9mh": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private" }, "dooplex:gitea/gitea|GHSA-q55v-4cmj-xh65": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials" }, @@ -1074,7 +1074,7 @@ }, "dooplex:gitea/gitea|GHSA-q9pg-jj6x-j9p6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I" }, @@ -1092,37 +1092,37 @@ }, "dooplex:gitea/gitea|GHSA-r96c-jc75-rxv6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea workflow badge bypasses API token scopes" }, "dooplex:gitea/gitea|GHSA-r9ch-mqjm-g67v": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events" }, "dooplex:gitea/gitea|GHSA-rcr6-4jqh-j84m": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Remote Code Execution via diffpatch Git Hook Installation" }, "dooplex:gitea/gitea|GHSA-rfm6-r2x5-cg56": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API" }, "dooplex:gitea/gitea|GHSA-rgv6-xp99-6mgj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea Remember-Me Token Theft Not Invalidating Attacker Session" }, "dooplex:gitea/gitea|GHSA-rh79-75qm-gwjr": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Gitea LFS Deploy-Key Privilege Escalation" }, @@ -1135,13 +1135,13 @@ }, "dooplex:gitea/gitea|GHSA-v2w8-m4gr-qj65": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation" }, "dooplex:gitea/gitea|GHSA-v73x-hx65-6pf4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Unauthorized Access to Labels of Private Organizations" }, @@ -1160,7 +1160,7 @@ }, "dooplex:gitea/gitea|GHSA-vrhc-jjfc-m3m3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)" }, @@ -1173,43 +1173,43 @@ }, "dooplex:gitea/gitea|GHSA-vxv2-8j6r-pcpg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)" }, "dooplex:gitea/gitea|GHSA-w4wc-g858-3672": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)" }, "dooplex:gitea/gitea|GHSA-w5pg-649r-p6gg": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag" }, "dooplex:gitea/gitea|GHSA-wg93-gp4m-c6vr": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Restricted users can read limited-visibility users' issue titles and bodies through issue search" }, "dooplex:gitea/gitea|GHSA-wrf9-r3h7-7x5v": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Fork Synchronization Continues After Parent Repository Changes from Public to Private" }, "dooplex:gitea/gitea|GHSA-ww9q-7j5q-hrv5": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Token Scope Bypass on `GET /api/v1/orgs`" }, "dooplex:gitea/gitea|GHSA-wwmh-7r9x-fg49": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Restricted users can read limited-visibility users’ SSH and GPG keys through the API" }, @@ -1228,7 +1228,7 @@ }, "dooplex:gitea/gitea|GHSA-x58h-3mx5-q44r": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Repository migration skips public-only token guard for private repository creation" }, @@ -1240,7 +1240,7 @@ }, "dooplex:gitea/gitea|GHSA-x77v-q46j-393g": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim" }, @@ -1274,31 +1274,31 @@ }, "dooplex:gitea/gitea|GHSA-xmj7-xj85-hfc3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL" }, "dooplex:gitea/gitea|GHSA-xv9x-fj9g-vj6h": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access" }, "dooplex:gitea/gitea|GHSA-xvfh-qwmh-f92w": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "API routes for user social graph, keys, and starred repos bypass private visibility check" }, "dooplex:gitea/gitea|GHSA-xxjv-752h-3vp2": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Public-only repository tokens can update private PR head branches" }, "dooplex:gitea/gitea|release:go-gitea/gitea@v1.27.0": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", "summary": "Fix: various security fixes ( #38406 ) ( #38426 )" }, @@ -1332,19 +1332,19 @@ }, "dooplex:grafana/grafana|release:grafana/grafana@v13.2.5": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", "summary": "Security: Fix CVE-2026-100105" }, "dooplex:grafana/grafana|release:grafana/grafana@v13.3.0": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", "summary": "Security: Fix CVE-2026-100105" }, "dooplex:louislam/uptime-kuma|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -1356,7 +1356,7 @@ }, "dooplex:louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, @@ -1374,7 +1374,7 @@ }, "dooplex:outlinewiki/outline|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "outlinewiki/outline 1.11.0 (outline-system/outline.yaml)", "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -1421,79 +1421,79 @@ }, "dooplex:redis|GHSA-4c68-q8q8-3g4f": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Out of bound read due to a bug in LUA" }, "dooplex:redis|GHSA-4q32-c38c-pwgq": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Redis DoS Vulnerability due to bad connection error handling" }, "dooplex:redis|GHSA-5453-q98w-cmvm": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "redis-check-aof may lead to stack overflow and potential RCE" }, "dooplex:redis|GHSA-8ghh-qpmp-7826": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Lua Use-After-Free may lead to remote code execution" }, "dooplex:redis|GHSA-93m2-935m-8rj3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Use-After-Free in unblock client flow may lead to remote code execution" }, "dooplex:redis|GHSA-c8h9-259x-jff4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution" }, "dooplex:redis|GHSA-m8fj-85cg-7vhp": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Lua library commands may lead to integer overflow and potential RCE" }, "dooplex:redis|GHSA-prpq-rh5h-46g9": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Denial-of-service due to malformed ACL selectors" }, "dooplex:redis|GHSA-qrv7-wcrx-q5jp": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Running Lua function as a different user" }, "dooplex:redis|GHSA-r67f-p999-2gff": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client" }, "dooplex:redis|GHSA-rp2m-q4j6-gr43": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Out of bounds write in hyperloglog commands leads to RCE" }, "dooplex:redis|release:redis/redis@8.10.3": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "redis 8.10.2 (plantit-system/plantit.yaml)", "summary": "Update urgency: SECURITY: There is a security fix in the release" }, "dooplex:rommapp/romm|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -1505,7 +1505,7 @@ }, "dooplex:vabene1111/recipes|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, @@ -1523,61 +1523,61 @@ }, "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Stored XSS in SVG Hotlinks" }, "f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "File Request MaxSize Limit Bypassed in File Request" }, "f0rc3/gokapi|GHSA-4xg4-54hm-9j77": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Stored XSS vulnerability in friendly name for API keys" }, "f0rc3/gokapi|GHSA-95rc-wc32-gm53": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Stored XSS by uploading file with malicious file name" }, "f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Data Leak in Upload Status Stream" }, "f0rc3/gokapi|GHSA-hcff-qv74-7hr4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "CSRF in Login Endpoint" }, "f0rc3/gokapi|GHSA-j6jp-78w8-34x6": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Privilege Escalation in File Replace" }, "f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Privilege escalation with auth token" }, "f0rc3/gokapi|GHSA-q658-hfpg-35qc": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion" }, "f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "f0rc3/gokapi v1.9.6 (gokapi)", "summary": "DoS in API endpoint" }, @@ -1637,19 +1637,19 @@ }, "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV" }, @@ -1660,38 +1660,6 @@ "silent": "first read after the seed", "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft" }, - "ghcr.io/lukegus/termix|release:Termix-SSH/Termix@v26.10.6": { - "first": "2026-10-30", - "last_mailed": "2026-10-30", - "program": "ghcr.io/lukegus/termix 26.10.5 (termix)", - "summary": "0 for a security fix" - }, - "ghcr.io/mealie-recipes/mealie|release:mealie-recipes/mealie@v3.30.0": { - "first": "2026-11-01", - "last_mailed": "2026-11-01", - "program": "ghcr.io/mealie-recipes/mealie v3.29.0 (mealie)", - "summary": "fix(deps): update dependency pillow to v13 [security] @ renovate[bot] ( #8822 )" - }, - "ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)", - "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" - }, - "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": { - "first": "2026-10-27", - "last_mailed": "2026-11-03", - "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", - "silent": "first read after the seed", - "summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled" - }, - "ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": { - "first": "2026-10-27", - "last_mailed": "2026-11-03", - "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", - "silent": "first read after the seed", - "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents" - }, "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": { "first": "2026-10-27", "last_mailed": "2026-11-03", @@ -1750,13 +1718,13 @@ }, "grafana/grafana|release:grafana/grafana@v13.3.0": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", "summary": "Security: Fix CVE-2026-100105" }, "gtstef/filebrowser|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "gtstef/filebrowser 1.5.8-stable (controller infra)", "summary": "Alpine brotli-libs 1.2.0-r1 inside the image: the Brotli library of the image's Alpine base (HTTP2Shell)" }, @@ -1972,16 +1940,10 @@ }, "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, - "n8nio/n8n|GHSA-2x68-96jw-5r6c": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node" - }, "n8nio/n8n|GHSA-365g-vjw2-grx8": { "first": "2026-10-27", "last_mailed": "2026-11-03", @@ -1989,72 +1951,6 @@ "silent": "first read after the seed", "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host" }, - "n8nio/n8n|GHSA-426f-xmcv-g8pg": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback" - }, - "n8nio/n8n|GHSA-4v22-g448-h4rg": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "MongoDB Node Update Operations Can Modify Unintended Documents" - }, - "n8nio/n8n|GHSA-9p7v-45m2-wxgj": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Deprecated Code Nodes Allow Code Execution in the n8n Main Process" - }, - "n8nio/n8n|GHSA-9qx8-fhxv-w794": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Browser Use Upload Tool Reads Arbitrary Files from the n8n Server" - }, - "n8nio/n8n|GHSA-f2cw-9483-7vcp": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Insecure GraphicsMagick Configuration" - }, - "n8nio/n8n|GHSA-gx3v-3x3v-f8r5": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Insufficient Isolation in Workflow Expression Evaluation" - }, - "n8nio/n8n|GHSA-jmcg-c7p5-q69g": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments" - }, - "n8nio/n8n|GHSA-mx4r-96jx-v278": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret" - }, - "n8nio/n8n|GHSA-prmc-fg87-r4gh": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects" - }, - "n8nio/n8n|GHSA-pwj5-wwm6-g83j": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests" - }, - "n8nio/n8n|GHSA-rc3w-8jc8-7x3w": { - "first": "2026-10-29", - "last_mailed": "2026-10-29", - "program": "n8nio/n8n 2.44.7 (n8n)", - "summary": "Open Redirect via MCP OAuth Dynamic Client Registration" - }, "privatebin/pdo|GHSA-c4gc-8mcm-hh65": { "first": "2026-10-30", "last_mailed": "2026-10-30", @@ -2069,7 +1965,7 @@ }, "rommapp/romm|CVE-2026-111497": { "first": "2026-10-28", - "last_mailed": "2026-10-28", + "last_mailed": "2026-11-04", "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" } @@ -2271,6 +2167,21 @@ "python": null, "unchecked": [] }, + "sha256:1a08d8dfc2b51a08de09652dd86ad4d0c611c362382f944533ad38b73125fbc4": { + "apk": {}, + "brotli": "1.2.1", + "brotlicffi": null, + "digest": "sha256:fd6d363d8fd783781775663f4acf9195bc000dfb9f569fddd9cbdd8d656e5605", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1" + }, + "env": { + "PYTHON_VERSION": "3.14.9" + }, + "node": null, + "python": "3.14.9", + "unchecked": [] + }, "sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0": { "apk": {}, "brotli": null, @@ -2438,19 +2349,6 @@ "python": null, "unchecked": [] }, - "sha256:28a627c1e2a568ea8c2d3fd83861675fdd3d8327a09f5a245c399b4864ad5ceb": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:8a66d1c70f95d205fbaa24628bbe39d9a3fbce72c1d740d744e57076bfc92396", - "dpkg": {}, - "env": { - "NODE_VERSION": "24.22.1" - }, - "node": "24.22.1", - "python": null, - "unchecked": [] - }, "sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6": { "apk": {}, "brotli": null, @@ -2462,6 +2360,19 @@ "python": null, "unchecked": [] }, + "sha256:2cb95d37f13c2b98edb404a2cfa13cff190ac3043033f8d9be04c0798e43a5d4": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:5109596eb8c76517df640b57363f15ae46a91923e9b0575cb597e436a123adf6", + "dpkg": {}, + "env": { + "NODE_VERSION": "24.22.2" + }, + "node": "24.22.2", + "python": null, + "unchecked": [] + }, "sha256:2e759dd1478a2ed119ee474e28522079fb1cfa50b3fd25cba89f6b9a67abad72": { "apk": { "brotli-libs": "1.2.0-r0", @@ -2502,17 +2413,6 @@ "python": null, "unchecked": [] }, - "sha256:30ff62491aacdb862ceb8c9edcf2627da638d7deafdd4b6dab32fe34f8aa3e90": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:c999a937a1bb51ba36c79adf2c9db1d1bb196896b66d524d30ef4945606d565f", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:32ab73d80f2b8b5fb0735b0431deb36b93fbb6b2fb43592449b0178c8b83e350": { "apk": {}, "brotli": null, @@ -2641,21 +2541,6 @@ "python": null, "unchecked": [] }, - "sha256:4384b9ff20a78bc1708c35ce7864f84f724611de7801fb36d715998db7c000f1": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:76507b062b1b63966557dc42048005720fa2c3185c9d1600cc67ae71a65f1cde", - "dpkg": {}, - "env": { - "NODE_VERSION": "26.12.1-r0" - }, - "node": "26.12.1-r0", - "python": null, - "unchecked": [] - }, "sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb": { "apk": { "brotli-libs": "1.1.0-r1" @@ -2749,6 +2634,21 @@ "python": null, "unchecked": [] }, + "sha256:4ebd866ae91d222ffa6dd3731eade80ba71b4d13f7470172a7e66a81fe31faa0": { + "apk": { + "brotli-libs": "1.2.0-r1" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:b3a677c1ff710cb7eacdfcfe7ff83fe1e7078ede36547ed5ed507b9cd7b88b78", + "dpkg": {}, + "env": { + "NODE_VERSION": "26.12.1-r0" + }, + "node": "26.12.1-r0", + "python": null, + "unchecked": [] + }, "sha256:4f733dc50b0c77517db402541f88c5489d4c9eedb32ac6c5eef7cadd8a594196": { "apk": {}, "brotli": null, @@ -2764,21 +2664,6 @@ "python": null, "unchecked": [] }, - "sha256:515c072ea1cf82ece3503f301fdf75dd5a7148abcc8fa10aaefd5ec56643b703": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:e881320833451d8320727d7e20386c39021d51ba03bbb1e153ddfeb114ce6145", - "dpkg": { - "libbrotli1": "1.1.0-2+deb13u1", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" - }, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:54d9406cd30f9e206a9dd6d61dfac48da26b9afc37200e14f23beb8fafa7d11c": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2914,6 +2799,17 @@ "python": null, "unchecked": [] }, + "sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:c999a937a1bb51ba36c79adf2c9db1d1bb196896b66d524d30ef4945606d565f", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:69ae5315c618b7c14c1af3e34c6e211acdb231793af424ecd1cab0b70691d987": { "apk": {}, "brotli": null, @@ -2944,21 +2840,6 @@ "python": null, "unchecked": [] }, - "sha256:6c86cad803970ea782683a8e80e7403444c5bf3cf70de63b4d3c8e87500db92f": { - "apk": {}, - "brotli": "1.1.0", - "brotlicffi": null, - "digest": "sha256:835974fc3368fc6714aa38542db7a1f0f542d03244e39b981e519aefc100f355", - "dpkg": { - "libbrotli1": "1.1.0-2+b7" - }, - "env": { - "PYTHON_VERSION": "3.12.12" - }, - "node": null, - "python": "3.12.12", - "unchecked": [] - }, "sha256:6f8f1fc29d1ff67b4d8d503bb4e0a69b55c8d42600decafde951344218193a27": { "apk": { "brotli-libs": "1.1.0-r2" @@ -3014,21 +2895,6 @@ "python": null, "unchecked": [] }, - "sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:243e33ea66e71b2094cb1f9c9167af24452405a33fc899a1dc7359dc210506f8", - "dpkg": { - "libbrotli1": "1.1.0-2+b7" - }, - "env": { - "PYTHON_VERSION": "3.14.8" - }, - "node": null, - "python": "3.14.8", - "unchecked": [] - }, "sha256:7a6779d345d4d678614aa1a0a8a4d8456aeb98de10dfae700b839c3140c89f39": { "apk": { "brotli-libs": "1.2.0-r1" @@ -3070,6 +2936,17 @@ "python": null, "unchecked": [] }, + "sha256:7f48c8692d6777facd63268fb9ac553db68bfc3141163ec8e888c1fbbe7fc7ab": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:55fc1fd053198eb81f532cece5a6695ec283bce8c18b9c27433f510b94aa9684", + "dpkg": {}, + "env": {}, + "node": "26.12.1", + "python": null, + "unchecked": [] + }, "sha256:823dc5036b911696c27faacf7664219b28e6e15826405720df29aad208d19f25": { "apk": {}, "brotli": null, @@ -3100,6 +2977,23 @@ "python": "3.14.10", "unchecked": [] }, + "sha256:84845e38ccf4487fbca6b580f19dd8a6c65669bf384ea7463ab018ca8a47c0dc": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:370c3266fd0c520490ca765006803c42dd9775db2a57d4c1e0a7a1438d7ec910", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1", + "python3": "3.13.5-1", + "python3.13": "3.13.5-2+deb13u5" + }, + "env": { + "PYTHON_VERSION": "3.13.18" + }, + "node": null, + "python": "3.13.18", + "unchecked": [] + }, "sha256:849f63732d3e751f077c1567bda77aebc68c8b5691271cb418e10efbcf2f364f": { "apk": { "brotli-libs": "1.2.1-r0" @@ -3220,21 +3114,19 @@ "python": null, "unchecked": [] }, - "sha256:90b7a39bdfd77286448e4a79eef393cf1a6700da2a601da1ae89234abe70efe8": { + "sha256:90f83da6f3ab0a421efc827118a556168573930105f13fa3321768f42163d784": { "apk": {}, "brotli": null, "brotlicffi": null, - "digest": "sha256:21486bcf50f454338fa38f1615571390da95e0b2bf0ddeb722c9af80a548c862", + "digest": "sha256:d552b662eb93f4dafa127fccfd8db9139e24c249753c72c17c9248edbc21e0c8", "dpkg": { - "libbrotli1": "1.1.0-2+deb13u1", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" + "libbrotli1": "1.1.0-2+deb13u1" }, "env": { - "PYTHON_VERSION": "3.13.18" + "PYTHON_VERSION": "3.14.8" }, "node": null, - "python": "3.13.18", + "python": "3.14.8", "unchecked": [] }, "sha256:92bfd78d731e254ba64f62b77b0696add6447a33642ee5feda106a26b285aa7f": { @@ -3550,6 +3442,21 @@ "python": null, "unchecked": [] }, + "sha256:b2255a301d94e004f1af0370e5f1256ffb4ee156b231ac4e76aadd6c0e5b44a4": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:e881320833451d8320727d7e20386c39021d51ba03bbb1e153ddfeb114ce6145", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1", + "python3": "3.13.5-1", + "python3.13": "3.13.5-2+deb13u5" + }, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:b3b00047ed20f6ce2b16780145cb6a0acb51c9e28ea6aa6f5dcd33c7034f1797": { "apk": { "brotli-libs": "1.2.0-r1" @@ -3617,17 +3524,6 @@ "python": null, "unchecked": [] }, - "sha256:ba97c3cb4f9cf979163f64855b7a4d5ecb36445a9b32ba50ac4f3c4fccd6f930": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:88991c3a845e395340a4dd2118015516ddd0544867cb19733b0eba373cb7a217", - "dpkg": {}, - "env": {}, - "node": "26.12.1", - "python": null, - "unchecked": [] - }, "sha256:bbe684a02d6b0db54256ff88eac9754f4519284a7b26314afc241fd7d0918191": { "apk": { "brotli-libs": "1.2.1-r0"