From ecae56559c5aca1a8d0625efa4affe657ae83d33 Mon Sep 17 00:00:00 2001 From: felhom security watch Date: Thu, 29 Oct 2026 03:45:11 +0000 Subject: [PATCH] security-watch: memory of 2026-10-29 (R-1303). Docs only. --- documentation/security-watch/state.json | 3433 +++++++++++------------ 1 file changed, 1662 insertions(+), 1771 deletions(-) diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json index 4e812b02..5b7064f8 100644 --- a/documentation/security-watch/state.json +++ b/documentation/security-watch/state.json @@ -6,12 +6,6 @@ "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" }, - "advplyr/audiobookshelf|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "advplyr/audiobookshelf 2.37.1 (audiobookshelf-system/audiobookshelf.yaml)", - "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, "calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -92,12 +86,1304 @@ "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)", "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" }, - "docker.io/calcom/cal.com|CVE-2026-111497": { + "dooplex:actualbudget/actual-server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "actualbudget/actual-server 26.10.0 (actualbudget-system/actualbudget.yaml)", + "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:advplyr/audiobookshelf|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "advplyr/audiobookshelf 2.37.1 (audiobookshelf-system/audiobookshelf.yaml)", + "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:codewithcj/sparkyfitness_server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:codewithcj/sparkyfitness_server|release:CodeWithCJ/SparkyFitness@v1.10.0": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "1 for CVE-2026-111497 by @nalvazhvu in #3111" + }, + "dooplex:codewithcj/sparkyfitness|release:CodeWithCJ/SparkyFitness@v1.10.0": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "codewithcj/sparkyfitness v1.9.0 (workout-system/sparkyfitness.yaml)", + "summary": "1 for CVE-2026-111497 by @nalvazhvu in #3111" + }, + "dooplex:crocodilestick/calibre-web-automated|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "crocodilestick/calibre-web-automated dev (calibre-system/cwa.yaml)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" + }, + "dooplex:docker.io/calcom/cal.com|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "docker.io/calcom/cal.com v6.2.0 (booking-system/booking.yaml)", "summary": "Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" }, + "dooplex:flomp/wanderer-db|GHSA-3xp7-7492-j2q6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" + }, + "dooplex:flomp/wanderer-db|GHSA-fprh-3pp9-68m9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" + }, + "dooplex:flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" + }, + "dooplex:flomp/wanderer-db|GHSA-vprp-gr6m-j375": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" + }, + "dooplex:flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "flomp/wanderer-db v0.20.0 (wanderer)", + "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" + }, + "dooplex:flomp/wanderer-web|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:flomp/wanderer-web|GHSA-3xp7-7492-j2q6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" + }, + "dooplex:flomp/wanderer-web|GHSA-fprh-3pp9-68m9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" + }, + "dooplex:flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" + }, + "dooplex:flomp/wanderer-web|GHSA-vprp-gr6m-j375": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", + "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" + }, + "dooplex:flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "flomp/wanderer-web v0.20.0 (wanderer)", + "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" + }, + "dooplex:ghcr.io/gethomepage/homepage|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml)", + "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)", + "silent": "first read after the seed", + "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-3mh5-gqfm-phgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-72rm-x7xr-v679": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "One-click account takeover via XSS in login page continue redirect" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-c9mf-h82r-8p4j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-g4w3-c888-cr93": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-h5w4-vjv4-9r5q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-hfvf-5c8x-8rc4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-hv27-723h-qfjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-jrp5-g662-hq92": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-q89f-h332-8q2h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" + }, + "dooplex:ghcr.io/immich-app/immich-machine-learning|GHSA-qp2h-w794-2vhf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", + "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" + }, + "dooplex:ghcr.io/immich-app/immich-server|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Node.js 24.14.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-3mh5-gqfm-phgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-72rm-x7xr-v679": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "One-click account takeover via XSS in login page continue redirect" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-c9mf-h82r-8p4j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-g4w3-c888-cr93": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-h5w4-vjv4-9r5q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-hfvf-5c8x-8rc4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-hv27-723h-qfjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-jrp5-g662-hq92": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-q89f-h332-8q2h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" + }, + "dooplex:ghcr.io/immich-app/immich-server|GHSA-qp2h-w794-2vhf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", + "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" + }, + "dooplex:ghcr.io/lukegus/termix|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/lukegus/termix release-2.9.2 (termix-system/termix.yaml)", + "summary": "Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "ghcr.io/paperless-ngx/paperless-ngx 3.3.4 (paperless-system/paperless.yaml)", + "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" + }, + "dooplex:gitea/gitea|GHSA-25gq-j9jx-43pg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)" + }, + "dooplex:gitea/gitea|GHSA-2fcr-jfvc-vgg2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Two SSRF findings in Gitea 1.26.2" + }, + "dooplex:gitea/gitea|GHSA-2m9v-5q2g-58vq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Git LFS object reuse allows non-Code access to authorize private source objects" + }, + "dooplex:gitea/gitea|GHSA-2r5c-gw76-rh3w": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter" + }, + "dooplex:gitea/gitea|GHSA-2wm4-vwp6-v7xc": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata" + }, + "dooplex:gitea/gitea|GHSA-2xph-7j4g-43rg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)" + }, + "dooplex:gitea/gitea|GHSA-36q5-5423-vgx2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory" + }, + "dooplex:gitea/gitea|GHSA-3pww-vcvm-3gmj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data" + }, + "dooplex:gitea/gitea|GHSA-3r5c-2xxx-h872": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Webhook Authorization Header Returned in Plaintext via API" + }, + "dooplex:gitea/gitea|GHSA-44qc-pgvp-wx7v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Notification API leaks private issue metadata after access revocation" + }, + "dooplex:gitea/gitea|GHSA-467c-4w7p-8427": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Algorithmic Complexity DoS in Issue Reference Parsing" + }, + "dooplex:gitea/gitea|GHSA-469m-x4mw-38r3": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "OAuth access tokens can be exchanged as refresh tokens" + }, + "dooplex:gitea/gitea|GHSA-46c7-w5w4-h644": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Email Management API Bypasses ManageCredentials Feature Restrictions" + }, + "dooplex:gitea/gitea|GHSA-46px-6cqx-c5fv": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Authenticated DoS in OneDev migration via unbounded version response body" + }, + "dooplex:gitea/gitea|GHSA-4j4g-m7mr-hp5j": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency" + }, + "dooplex:gitea/gitea|GHSA-4jmf-h2cm-hg7w": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`" + }, + "dooplex:gitea/gitea|GHSA-4xjf-493q-98p3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea SSH Key Parser Denial of Service" + }, + "dooplex:gitea/gitea|GHSA-54w9-6cc5-9wj9": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false" + }, + "dooplex:gitea/gitea|GHSA-579w-82gf-89m2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Remote Code Execution via unescaped markup `Context` into external renderer argv" + }, + "dooplex:gitea/gitea|GHSA-5952-x23q-p23f": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Authenticated DoS in GitLab migration via uncancelable version probe" + }, + "dooplex:gitea/gitea|GHSA-5ggr-2f2h-jmvm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Local File Inclusion via file:// URI in Migration Restore" + }, + "dooplex:gitea/gitea|GHSA-5w72-2mqm-qh46": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Wiki-only members can read private pull request titles through markup preview" + }, + "dooplex:gitea/gitea|GHSA-5xcq-p92v-43rf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Package size quota bypass and unbounded memory read in the Maven checksum upload path" + }, + "dooplex:gitea/gitea|GHSA-5xp7-r6cr-39ff": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request" + }, + "dooplex:gitea/gitea|GHSA-66m4-5jjr-2rg5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocatio" + }, + "dooplex:gitea/gitea|GHSA-683j-3ff6-hh2x": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Privilege Escalation via Access Token Scope Escalation in API" + }, + "dooplex:gitea/gitea|GHSA-6c6r-5xr4-cr5m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository issue/comment attachment re-linking can expose private attachment content" + }, + "dooplex:gitea/gitea|GHSA-6cqf-375w-639g": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)" + }, + "dooplex:gitea/gitea|GHSA-6f9g-7jgm-m5ph": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS" + }, + "dooplex:gitea/gitea|GHSA-6g2h-xpg3-rm48": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" + }, + "dooplex:gitea/gitea|GHSA-6hm7-3pwj-22rm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload" + }, + "dooplex:gitea/gitea|GHSA-6pv5-8rp7-8c75": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one" + }, + "dooplex:gitea/gitea|GHSA-7769-9pr9-m24h": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Deploy keys impersonate the repository owner in the hook pipeline" + }, + "dooplex:gitea/gitea|GHSA-777r-4v59-6486": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Permanent Fork PR Workflow Approval Gate Bypass" + }, + "dooplex:gitea/gitea|GHSA-7cq7-4v93-8wjm": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)" + }, + "dooplex:gitea/gitea|GHSA-7p4h-3gxq-x3h3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118" + }, + "dooplex:gitea/gitea|GHSA-7v5j-mph8-9w6g": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller" + }, + "dooplex:gitea/gitea|GHSA-7w2r-xwp6-mh6c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)" + }, + "dooplex:gitea/gitea|GHSA-7wvc-rvp7-w99x": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories" + }, + "dooplex:gitea/gitea|GHSA-8hhh-mqpg-jpxc": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy" + }, + "dooplex:gitea/gitea|GHSA-8j56-f865-gqq2": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Draft releases include attachment metadata from other repositories" + }, + "dooplex:gitea/gitea|GHSA-8p9h-49rc-qgxj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository Visibility Manipulation via Git Push Options" + }, + "dooplex:gitea/gitea|GHSA-8pwg-hcgm-54cp": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" + }, + "dooplex:gitea/gitea|GHSA-8r3w-5682-jrqf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded gitignores repository-creation field enables linear template-read amplification" + }, + "dooplex:gitea/gitea|GHSA-8vmh-w35x-73qr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthenticated Blind SSRF via OpenID Sign-In Verification" + }, + "dooplex:gitea/gitea|GHSA-8xjr-x7rg-hp5h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "2FA bypass and persistent account takeover via OpenID identity linking" + }, + "dooplex:gitea/gitea|GHSA-92j2-6qcg-c28c": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)" + }, + "dooplex:gitea/gitea|GHSA-93pj-3x56-5gc2": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Cancelled fork-PR Actions jobs are revived by later approval" + }, + "dooplex:gitea/gitea|GHSA-94rx-fqm6-q23v": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Stored XSS via Repository Media API" + }, + "dooplex:gitea/gitea|GHSA-94v3-77j7-vm48": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)" + }, + "dooplex:gitea/gitea|GHSA-96gv-2xc4-4hxj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade" + }, + "dooplex:gitea/gitea|GHSA-96qg-qxxj-r8xq": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments" + }, + "dooplex:gitea/gitea|GHSA-9h7g-h754-c8x2": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification" + }, + "dooplex:gitea/gitea|GHSA-9mq6-mqjj-c2c5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads" + }, + "dooplex:gitea/gitea|GHSA-c3cr-qq9g-666c": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" + }, + "dooplex:gitea/gitea|GHSA-cp3q-vrj2-ghhh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents" + }, + "dooplex:gitea/gitea|GHSA-cwq7-782w-pxcc": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases" + }, + "dooplex:gitea/gitea|GHSA-f75j-4cw6-rmx4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`" + }, + "dooplex:gitea/gitea|GHSA-f8ph-p9p5-vg2p": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthenticated artifact-to-repository oracle in raw Actions downloads" + }, + "dooplex:gitea/gitea|GHSA-fj8v-hjwv-qm88": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)" + }, + "dooplex:gitea/gitea|GHSA-fq2p-5p22-8g6j": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints" + }, + "dooplex:gitea/gitea|GHSA-fqjr-23c8-gg9m": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS" + }, + "dooplex:gitea/gitea|GHSA-fqxf-w92m-prvq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Swift registry per-file 128KiB manifest guard bypassed by aggregation" + }, + "dooplex:gitea/gitea|GHSA-frpv-2xgv-wxpq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in th" + }, + "dooplex:gitea/gitea|GHSA-frpw-3h2q-4jj6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs" + }, + "dooplex:gitea/gitea|GHSA-fw57-jgch-pgf3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests" + }, + "dooplex:gitea/gitea|GHSA-fxq4-gr55-7x5g": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels" + }, + "dooplex:gitea/gitea|GHSA-g4hw-fg4c-89mq": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches" + }, + "dooplex:gitea/gitea|GHSA-g5jj-gp8w-73h7": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess" + }, + "dooplex:gitea/gitea|GHSA-gx3v-q759-g323": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface" + }, + "dooplex:gitea/gitea|GHSA-h2x6-g7q6-344v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository migration SSRF via multi-answer DNS allow-list bypass" + }, + "dooplex:gitea/gitea|GHSA-h56g-4qw7-2mxg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only API token restriction is not enforced on team API routes" + }, + "dooplex:gitea/gitea|GHSA-h62v-wmrr-5qjq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Admin repository collaborator can self-escalate to Owner and transfer the repository" + }, + "dooplex:gitea/gitea|GHSA-hcgw-r9gf-8mph": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories" + }, + "dooplex:gitea/gitea|GHSA-hch4-r2j8-xm72": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate" + }, + "dooplex:gitea/gitea|GHSA-hf55-9cwq-2x64": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs" + }, + "dooplex:gitea/gitea|GHSA-hxhc-246f-rvqc": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Organization repository creation endpoint skips repository token scope" + }, + "dooplex:gitea/gitea|GHSA-j2w3-9c3r-g83q": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private Repository Metadata Remains Accessible After Access Revocation" + }, + "dooplex:gitea/gitea|GHSA-j72v-mjr6-3424": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)" + }, + "dooplex:gitea/gitea|GHSA-jj5r-9rpc-8h6h": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti" + }, + "dooplex:gitea/gitea|GHSA-jr5x-6h83-wrxf": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "REST API exposes organization membership of private organizations to public" + }, + "dooplex:gitea/gitea|GHSA-m6qc-j894-7h9r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting" + }, + "dooplex:gitea/gitea|GHSA-m78w-jjjx-gp8r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)" + }, + "dooplex:gitea/gitea|GHSA-m932-crvm-gcp5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service" + }, + "dooplex:gitea/gitea|GHSA-m984-2424-x6vw": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Generic attachment downloads bypass draft-release visibility checks" + }, + "dooplex:gitea/gitea|GHSA-mf69-7pqq-86vx": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" + }, + "dooplex:gitea/gitea|GHSA-mg4f-x9v4-6h2p": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes" + }, + "dooplex:gitea/gitea|GHSA-mw6q-qj47-9g5q": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash" + }, + "dooplex:gitea/gitea|GHSA-p3pc-g8m5-hrrr": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection" + }, + "dooplex:gitea/gitea|GHSA-p3rv-cr5f-9gjh": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation" + }, + "dooplex:gitea/gitea|GHSA-p4mj-98mv-xq26": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint" + }, + "dooplex:gitea/gitea|GHSA-pgqf-926r-548m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API" + }, + "dooplex:gitea/gitea|GHSA-pq8x-xpgp-rvmh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Permissive Git hook directory and script modes may allow local code execution as the Gitea service account" + }, + "dooplex:gitea/gitea|GHSA-prr9-9mp4-5gp2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Private org member list leaked via /members API endpoint — incomplete fix for PR #38145" + }, + "dooplex:gitea/gitea|GHSA-pvjf-7jrm-6w9g": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun" + }, + "dooplex:gitea/gitea|GHSA-px3q-x2mm-55wg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Package registry: restricted users can read packages of limited-visibility users (authorization bypass)" + }, + "dooplex:gitea/gitea|GHSA-q423-49rw-g9mh": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private" + }, + "dooplex:gitea/gitea|GHSA-q55v-4cmj-xh65": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials" + }, + "dooplex:gitea/gitea|GHSA-q9pg-jj6x-j9p6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I" + }, + "dooplex:gitea/gitea|GHSA-r96c-jc75-rxv6": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea workflow badge bypasses API token scopes" + }, + "dooplex:gitea/gitea|GHSA-r9ch-mqjm-g67v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events" + }, + "dooplex:gitea/gitea|GHSA-rcr6-4jqh-j84m": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Remote Code Execution via diffpatch Git Hook Installation" + }, + "dooplex:gitea/gitea|GHSA-rfm6-r2x5-cg56": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API" + }, + "dooplex:gitea/gitea|GHSA-rgv6-xp99-6mgj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea Remember-Me Token Theft Not Invalidating Attacker Session" + }, + "dooplex:gitea/gitea|GHSA-rh79-75qm-gwjr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Gitea LFS Deploy-Key Privilege Escalation" + }, + "dooplex:gitea/gitea|GHSA-rqhx-647v-wx32": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "SSRF via HTTP Redirect in Repository Migration" + }, + "dooplex:gitea/gitea|GHSA-v2w8-m4gr-qj65": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation" + }, + "dooplex:gitea/gitea|GHSA-v73x-hx65-6pf4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Unauthorized Access to Labels of Private Organizations" + }, + "dooplex:gitea/gitea|GHSA-vcp6-2qc6-gvq3": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" + }, + "dooplex:gitea/gitea|GHSA-vrhc-jjfc-m3m3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)" + }, + "dooplex:gitea/gitea|GHSA-vvqw-mjq8-x248": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs" + }, + "dooplex:gitea/gitea|GHSA-vxv2-8j6r-pcpg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)" + }, + "dooplex:gitea/gitea|GHSA-w4wc-g858-3672": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)" + }, + "dooplex:gitea/gitea|GHSA-w5pg-649r-p6gg": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag" + }, + "dooplex:gitea/gitea|GHSA-wg93-gp4m-c6vr": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can read limited-visibility users' issue titles and bodies through issue search" + }, + "dooplex:gitea/gitea|GHSA-wrf9-r3h7-7x5v": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fork Synchronization Continues After Parent Repository Changes from Public to Private" + }, + "dooplex:gitea/gitea|GHSA-ww9q-7j5q-hrv5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Token Scope Bypass on `GET /api/v1/orgs`" + }, + "dooplex:gitea/gitea|GHSA-wwmh-7r9x-fg49": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Restricted users can read limited-visibility users’ SSH and GPG keys through the API" + }, + "dooplex:gitea/gitea|GHSA-wx44-9m3m-rjqx": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Locked issues and comments still accept reactions through the web UI" + }, + "dooplex:gitea/gitea|GHSA-x4q3-gcj3-m6cf": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled" + }, + "dooplex:gitea/gitea|GHSA-x58h-3mx5-q44r": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Repository migration skips public-only token guard for private repository creation" + }, + "dooplex:gitea/gitea|GHSA-x77v-q46j-393g": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim" + }, + "dooplex:gitea/gitea|GHSA-x8c3-3rp8-2j46": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "API team demotion does not reset unit permissions" + }, + "dooplex:gitea/gitea|GHSA-xfqq-h54g-92f8": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access" + }, + "dooplex:gitea/gitea|GHSA-xh39-mxw9-34pp": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ" + }, + "dooplex:gitea/gitea|GHSA-xmfc-hqq8-33wh": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "gitea/gitea 1.27.3 (gitea)", + "silent": "first read after the seed", + "summary": "Private profile information leaks on POST request" + }, + "dooplex:gitea/gitea|GHSA-xmj7-xj85-hfc3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL" + }, + "dooplex:gitea/gitea|GHSA-xv9x-fj9g-vj6h": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access" + }, + "dooplex:gitea/gitea|GHSA-xvfh-qwmh-f92w": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "API routes for user social graph, keys, and starred repos bypass private visibility check" + }, + "dooplex:gitea/gitea|GHSA-xxjv-752h-3vp2": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Public-only repository tokens can update private PR head branches" + }, + "dooplex:gitea/gitea|release:go-gitea/gitea@v1.27.0": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", + "summary": "Fix: various security fixes ( #38406 ) ( #38426 )" + }, + "dooplex:grafana/grafana|GHSA-2x6g-h2hg-rq84": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "grafana/grafana 13.2.3 (grafana)", + "silent": "first read after the seed", + "summary": "Email addresses and usernames can not be trusted" + }, + "dooplex:grafana/grafana|GHSA-4724-7jwc-3fpw": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "grafana/grafana 13.2.3 (grafana)", + "silent": "first read after the seed", + "summary": "Spoofing originalUrl of snapshots" + }, + "dooplex:grafana/grafana|GHSA-8wjh-59cw-9xh4": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "grafana/grafana 13.2.3 (grafana)", + "silent": "first read after the seed", + "summary": "Forward OAuth Identity Token can allow users to access some data sources" + }, + "dooplex:grafana/grafana|GHSA-8xmm-x63g-f6xv": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "grafana/grafana 13.2.3 (grafana)", + "silent": "first read after the seed", + "summary": "Stored XSS in ResourcePicker component " + }, + "dooplex:grafana/grafana|release:grafana/grafana@v13.2.5": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", + "summary": "Security: Fix CVE-2026-100105" + }, + "dooplex:grafana/grafana|release:grafana/grafana@v13.3.0": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "grafana/grafana 13.2.4 (mon-system/monitoring.yaml)", + "summary": "Security: Fix CVE-2026-100105" + }, + "dooplex:louislam/uptime-kuma|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", + "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", + "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" + }, + "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", + "summary": "⬆️ Security Fixes" + }, + "dooplex:louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", + "summary": "⬆️ Security Fixes" + }, + "dooplex:outlinewiki/outline|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "outlinewiki/outline 1.11.0 (outline-system/outline.yaml)", + "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:outlinewiki/outline|GHSA-cprf-crfh-w3p4": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "outlinewiki/outline 1.10.1 (outline)", + "silent": "first read after the seed", + "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)" + }, + "dooplex:outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "outlinewiki/outline 1.10.1 (outline)", + "silent": "first read after the seed", + "summary": "Authenticated members can publish documents into private collections through a retained parent link" + }, + "dooplex:outlinewiki/outline|GHSA-rq53-m97j-f2pg": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "outlinewiki/outline 1.10.1 (outline)", + "silent": "first read after the seed", + "summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked" + }, + "dooplex:outlinewiki/outline|GHSA-rvj7-2gww-6xfq": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "outlinewiki/outline 1.10.1 (outline)", + "silent": "first read after the seed", + "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member" + }, + "dooplex:outlinewiki/outline|GHSA-x4w3-9p9j-cprh": { + "first": "2026-10-27", + "last_mailed": "2026-10-27", + "program": "outlinewiki/outline 1.10.1 (outline)", + "silent": "first read after the seed", + "summary": "users.update_role reveals whether a user id from another team exists and which role it has" + }, + "dooplex:outlinewiki/outline|release:outline/outline@v1.12.0": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "outlinewiki/outline 1.10.1 (outline)", + "summary": "1 which fixes multiple recently disclosed vulnerabilities" + }, + "dooplex:redis|GHSA-4c68-q8q8-3g4f": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Out of bound read due to a bug in LUA" + }, + "dooplex:redis|GHSA-4q32-c38c-pwgq": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Redis DoS Vulnerability due to bad connection error handling" + }, + "dooplex:redis|GHSA-5453-q98w-cmvm": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "redis-check-aof may lead to stack overflow and potential RCE" + }, + "dooplex:redis|GHSA-8ghh-qpmp-7826": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Lua Use-After-Free may lead to remote code execution" + }, + "dooplex:redis|GHSA-93m2-935m-8rj3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Use-After-Free in unblock client flow may lead to remote code execution" + }, + "dooplex:redis|GHSA-c8h9-259x-jff4": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution" + }, + "dooplex:redis|GHSA-m8fj-85cg-7vhp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Lua library commands may lead to integer overflow and potential RCE" + }, + "dooplex:redis|GHSA-prpq-rh5h-46g9": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Denial-of-service due to malformed ACL selectors" + }, + "dooplex:redis|GHSA-qrv7-wcrx-q5jp": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Running Lua function as a different user" + }, + "dooplex:redis|GHSA-r67f-p999-2gff": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client" + }, + "dooplex:redis|GHSA-rp2m-q4j6-gr43": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Out of bounds write in hyperloglog commands leads to RCE" + }, + "dooplex:redis|release:redis/redis@8.10.3": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "redis 8.10.2 (plantit-system/plantit.yaml)", + "summary": "Update urgency: SECURITY: There is a security fix in the release" + }, + "dooplex:rommapp/romm|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, + "dooplex:rommapp/romm|release:rommapp/romm@5.4.1": { + "first": "2026-10-26", + "last_mailed": "2026-10-26", + "program": "rommapp/romm 5.3.1 (romm)", + "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible" + }, + "dooplex:vabene1111/recipes|CVE-2026-111497": { + "first": "2026-10-28", + "last_mailed": "2026-10-28", + "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", + "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + }, "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -200,423 +1486,24 @@ "program": "fallenbagel/jellyseerr 2.7.3 (seerr)", "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo" }, - "flomp/wanderer-db|GHSA-332v-mq7g-5hqf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t" - }, - "flomp/wanderer-db|GHSA-3xp7-7492-j2q6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" - }, - "flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)" - }, - "flomp/wanderer-db|GHSA-fprh-3pp9-68m9": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" - }, - "flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" - }, - "flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验" - }, - "flomp/wanderer-db|GHSA-vj82-xj83-jp85": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o" - }, - "flomp/wanderer-db|GHSA-vprp-gr6m-j375": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" - }, - "flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list" - }, - "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )" - }, - "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "flomp/wanderer-db v0.20.0 (wanderer)", - "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" - }, - "flomp/wanderer-web|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "flomp/wanderer-web|GHSA-332v-mq7g-5hqf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t" - }, - "flomp/wanderer-web|GHSA-3xp7-7492-j2q6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources" - }, - "flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)" - }, - "flomp/wanderer-web|GHSA-fprh-3pp9-68m9": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc" - }, - "flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources" - }, - "flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验" - }, - "flomp/wanderer-web|GHSA-vj82-xj83-jp85": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o" - }, - "flomp/wanderer-web|GHSA-vprp-gr6m-j375": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.21.0 (wanderer-system/wanderer.yaml)", - "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources" - }, - "flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list" - }, - "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )" - }, - "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "flomp/wanderer-web v0.20.0 (wanderer)", - "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" - }, - "freikin/dawarich|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "freikin/dawarich 1.15.3 (dawarich)", - "summary": "Node.js 20.19.2 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process — no fixed release on t" - }, - "freikin/dawarich|release:Freika/dawarich@1.17.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "freikin/dawarich 1.15.3 (dawarich)", - "summary": "js 20 package, which no longer receives upstream security fixes" - }, - "ghcr.io/alexta69/metube|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/alexta69/metube 2026.09.29 (metube)", - "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" - }, - "ghcr.io/diced/zipline|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/diced/zipline 4.8.0 (zipline)", - "summary": "Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/gethomepage/homepage|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml)", - "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)", - "silent": "first read after the seed", - "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints" - }, - "ghcr.io/home-assistant/home-assistant|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)", - "summary": "Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-3mh5-gqfm-phgj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-72rm-x7xr-v679": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" - }, "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-c9mf-h82r-8p4j": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-g4w3-c888-cr93": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-h5w4-vjv4-9r5q": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-hfvf-5c8x-8rc4": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-hv27-723h-qfjq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-jrp5-g662-hq92": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-q89f-h332-8q2h": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" - }, - "ghcr.io/immich-app/immich-machine-learning|GHSA-qp2h-w794-2vhf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-machine-learning v2.7.5 (immich-system/immich.yaml)", - "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" - }, - "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)", - "summary": "com/ ) as well as some nodejs security patches" - }, - "ghcr.io/immich-app/immich-server|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Node.js 24.14.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/immich-app/immich-server|GHSA-3mh5-gqfm-phgj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints" - }, - "ghcr.io/immich-app/immich-server|GHSA-72rm-x7xr-v679": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service" - }, "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", "summary": "One-click account takeover via XSS in login page continue redirect" }, - "ghcr.io/immich-app/immich-server|GHSA-c9mf-h82r-8p4j": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints" - }, - "ghcr.io/immich-app/immich-server|GHSA-g4w3-c888-cr93": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API" - }, - "ghcr.io/immich-app/immich-server|GHSA-h5w4-vjv4-9r5q": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Incorrect sanitization of continue URL on the /maintenance endpoint" - }, - "ghcr.io/immich-app/immich-server|GHSA-hfvf-5c8x-8rc4": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "OIDC discovery/token/userinfo/JWKS fetches run with TLS certificate verification unconditionally disabled via allowInsecureRequests (CWE-295)" - }, - "ghcr.io/immich-app/immich-server|GHSA-hv27-723h-qfjq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Partner \"view-only\" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the " - }, - "ghcr.io/immich-app/immich-server|GHSA-jrp5-g662-hq92": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint" - }, - "ghcr.io/immich-app/immich-server|GHSA-q89f-h332-8q2h": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Authenticated SVG upload reaches ImageMagick coders and enables RCE" - }, - "ghcr.io/immich-app/immich-server|GHSA-qp2h-w794-2vhf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/immich-app/immich-server v2.7.5 (immich-system/immich.yaml)", - "summary": "Incomplete fix for login continue redirect allows slash-backslash open redirect" - }, - "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)", - "summary": "com/ ) as well as some nodejs security patches" - }, - "ghcr.io/karakeep-app/karakeep|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", - "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV" }, - "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", - "summary": "1 for its October security release ( #3196 )" - }, - "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", - "summary": "This is a security release on top of 0" - }, - "ghcr.io/lukegus/termix|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/lukegus/termix release-2.9.2 (termix-system/termix.yaml)", - "summary": "Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Cross-user nested automation execution bypasses ownership checks and runs actions with victim privileges" - }, - "ghcr.io/lukegus/termix|GHSA-6gr3-r7jx-wfmh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Two-factor authentication can be bypassed via a forged client-supplied device identifier" - }, - "ghcr.io/lukegus/termix|GHSA-7j7m-85p4-2cpm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Authentication Bypass by Spoofing and Improper Restriction of Excessive Authentication Attempts in Termix" - }, - "ghcr.io/lukegus/termix|GHSA-fj9w-vcj9-66qh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Termix: the automation `run_command` step substitutes untrusted template values straight into a shell command, ignoring the quoting contract its own template mo" - }, - "ghcr.io/lukegus/termix|GHSA-frx8-qqgg-7j7g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Termix Desktop: any website can obtain a session on the embedded backend (CORS allows all origins + passwordless loopback auto-session)" - }, - "ghcr.io/lukegus/termix|GHSA-hmv7-25x4-vp6w": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Termix: a read-only session-share guest can delete its own participant record and then type into the owner's live SSH session, turning a \"watch only\" link into " - }, - "ghcr.io/lukegus/termix|GHSA-j7j4-82wh-3vj5": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "LDAPS certificate validation is disabled, allowing MITM capture of LDAP and user credentials" - }, - "ghcr.io/lukegus/termix|GHSA-r7x4-j6x8-jxrx": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Authenticated users can mint Guacamole tokens for arbitrary RDP/VNC/Telnet targets" - }, "ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -624,27 +1511,6 @@ "silent": "first read after the seed", "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft" }, - "ghcr.io/lukegus/termix|GHSA-rgf3-2q88-q4wp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Cross-User File Manager SSH Session Termination and State Replacement" - }, - "ghcr.io/lukegus/termix|GHSA-v3vp-ffww-q7pw": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "Credential disclosure vulnerability in Termix" - }, - "ghcr.io/lukegus/termix|GHSA-wv2p-5jqw-9qf3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", - "silent": "first read after the seed", - "summary": "User-controlled Vault address is fetched without SSRF controls" - }, "ghcr.io/paperless-ngx/paperless-ngx|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", @@ -665,64 +1531,6 @@ "silent": "first read after the seed", "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents" }, - "ghcr.io/papra-hq/papra|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/papra-hq/papra 26.6.2-rootless (papra)", - "summary": "Node.js 26.4.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/seanmorley15/adventurelog-backend|release:seanmorley15/AdventureLog@v0.13.1": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/seanmorley15/adventurelog-backend v0.13.0 (adventurelog)", - "summary": "This release includes security updates for the backend, frontend, and container images" - }, - "ghcr.io/seanmorley15/adventurelog-frontend|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)", - "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/seanmorley15/adventurelog-frontend|release:seanmorley15/AdventureLog@v0.13.1": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 (adventurelog)", - "summary": "This release includes security updates for the backend, frontend, and container images" - }, - "ghcr.io/tandoorrecipes/recipes|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Recipe import subsystem: XXE local file read via lxml default parser (rezeptsuitede/Cookmate XML importers) and SSRF in the pestle importer left out of the GHSA" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-5p9v-743w-79h3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Shopping-list bulk create accepts foreign-Space Food/Unit/Ingredient IDs and returns their names" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-69q3-5q6x-7hmx": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Group-Permission Cache Key Omits Active Space" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-748x-xc8h-95hj": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "User can move an owned entry into another user’s unshared recipe book" - }, "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -737,707 +1545,6 @@ "silent": "first read after the seed", "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints" }, - "ghcr.io/tandoorrecipes/recipes|GHSA-pcq2-64qw-jm4x": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Private recipe overview disclosed through ShoppingListRecipe API in 2.6.15" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-vc5c-xh64-79vp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Fix for GHSA-5mw3-c978-gc6w checks UserSpace ids against User ids" - }, - "ghcr.io/tandoorrecipes/recipes|GHSA-xq7g-9q95-vjc6": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "silent": "first read after the seed", - "summary": "Server-Side Request Forgery (SSRF) in Pestle Recipe Import" - }, - "ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", - "summary": "fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3" - }, - "ghost|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "ghost 6.67.0-alpine (ghost)", - "summary": "Node.js 22.23.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "gitea/gitea|GHSA-25gq-j9jx-43pg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)" - }, - "gitea/gitea|GHSA-2fcr-jfvc-vgg2": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Two SSRF findings in Gitea 1.26.2" - }, - "gitea/gitea|GHSA-2m9v-5q2g-58vq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Git LFS object reuse allows non-Code access to authorize private source objects" - }, - "gitea/gitea|GHSA-2r5c-gw76-rh3w": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter" - }, - "gitea/gitea|GHSA-2wm4-vwp6-v7xc": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata" - }, - "gitea/gitea|GHSA-2xph-7j4g-43rg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Fork pull requests can read reusable workflow files from another private repository (missed sibling of GHSA-fj8v-hjwv-qm88)" - }, - "gitea/gitea|GHSA-36q5-5423-vgx2": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memory" - }, - "gitea/gitea|GHSA-3pww-vcvm-3gmj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data" - }, - "gitea/gitea|GHSA-3r5c-2xxx-h872": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Webhook Authorization Header Returned in Plaintext via API" - }, - "gitea/gitea|GHSA-44qc-pgvp-wx7v": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Notification API leaks private issue metadata after access revocation" - }, - "gitea/gitea|GHSA-467c-4w7p-8427": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Algorithmic Complexity DoS in Issue Reference Parsing" - }, - "gitea/gitea|GHSA-469m-x4mw-38r3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "OAuth access tokens can be exchanged as refresh tokens" - }, - "gitea/gitea|GHSA-46c7-w5w4-h644": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Email Management API Bypasses ManageCredentials Feature Restrictions" - }, - "gitea/gitea|GHSA-46px-6cqx-c5fv": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Authenticated DoS in OneDev migration via unbounded version response body" - }, - "gitea/gitea|GHSA-4j4g-m7mr-hp5j": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency" - }, - "gitea/gitea|GHSA-4jmf-h2cm-hg7w": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`" - }, - "gitea/gitea|GHSA-4xjf-493q-98p3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea SSH Key Parser Denial of Service" - }, - "gitea/gitea|GHSA-54w9-6cc5-9wj9": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false" - }, - "gitea/gitea|GHSA-579w-82gf-89m2": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Remote Code Execution via unescaped markup `Context` into external renderer argv" - }, - "gitea/gitea|GHSA-5952-x23q-p23f": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Authenticated DoS in GitLab migration via uncancelable version probe" - }, - "gitea/gitea|GHSA-5ggr-2f2h-jmvm": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Local File Inclusion via file:// URI in Migration Restore" - }, - "gitea/gitea|GHSA-5w72-2mqm-qh46": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Wiki-only members can read private pull request titles through markup preview" - }, - "gitea/gitea|GHSA-5xcq-p92v-43rf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Package size quota bypass and unbounded memory read in the Maven checksum upload path" - }, - "gitea/gitea|GHSA-5xp7-r6cr-39ff": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "A fork pull request author can satisfy a required Actions status check without any workflow running, because a filtered out workflow taken from the pull request" - }, - "gitea/gitea|GHSA-66m4-5jjr-2rg5": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocatio" - }, - "gitea/gitea|GHSA-683j-3ff6-hh2x": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Privilege Escalation via Access Token Scope Escalation in API" - }, - "gitea/gitea|GHSA-6c6r-5xr4-cr5m": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Cross-repository issue/comment attachment re-linking can expose private attachment content" - }, - "gitea/gitea|GHSA-6cqf-375w-639g": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)" - }, - "gitea/gitea|GHSA-6f9g-7jgm-m5ph": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS" - }, - "gitea/gitea|GHSA-6g2h-xpg3-rm48": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" - }, - "gitea/gitea|GHSA-6hm7-3pwj-22rm": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload" - }, - "gitea/gitea|GHSA-6pv5-8rp7-8c75": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one" - }, - "gitea/gitea|GHSA-7769-9pr9-m24h": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Deploy keys impersonate the repository owner in the hook pipeline" - }, - "gitea/gitea|GHSA-777r-4v59-6486": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Permanent Fork PR Workflow Approval Gate Bypass" - }, - "gitea/gitea|GHSA-7cq7-4v93-8wjm": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)" - }, - "gitea/gitea|GHSA-7p4h-3gxq-x3h3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118" - }, - "gitea/gitea|GHSA-7v5j-mph8-9w6g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller" - }, - "gitea/gitea|GHSA-7w2r-xwp6-mh6c": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea Actions: fork pull request approval bypass via `pull_request_review_comment` (missing `WithPullRequest`)" - }, - "gitea/gitea|GHSA-7wvc-rvp7-w99x": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories" - }, - "gitea/gitea|GHSA-8hhh-mqpg-jpxc": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy" - }, - "gitea/gitea|GHSA-8j56-f865-gqq2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Draft releases include attachment metadata from other repositories" - }, - "gitea/gitea|GHSA-8p9h-49rc-qgxj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Repository Visibility Manipulation via Git Push Options" - }, - "gitea/gitea|GHSA-8pwg-hcgm-54cp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" - }, - "gitea/gitea|GHSA-8r3w-5682-jrqf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unbounded gitignores repository-creation field enables linear template-read amplification" - }, - "gitea/gitea|GHSA-8vmh-w35x-73qr": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unauthenticated Blind SSRF via OpenID Sign-In Verification" - }, - "gitea/gitea|GHSA-8xjr-x7rg-hp5h": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "2FA bypass and persistent account takeover via OpenID identity linking" - }, - "gitea/gitea|GHSA-92j2-6qcg-c28c": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "WebAuthn second factor is bypassed on OAuth2/OpenID sign-in (WebAuthn-only users)" - }, - "gitea/gitea|GHSA-93pj-3x56-5gc2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Cancelled fork-PR Actions jobs are revived by later approval" - }, - "gitea/gitea|GHSA-94rx-fqm6-q23v": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Stored XSS via Repository Media API" - }, - "gitea/gitea|GHSA-94v3-77j7-vm48": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)" - }, - "gitea/gitea|GHSA-96gv-2xc4-4hxj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade" - }, - "gitea/gitea|GHSA-96qg-qxxj-r8xq": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments" - }, - "gitea/gitea|GHSA-9h7g-h754-c8x2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification" - }, - "gitea/gitea|GHSA-9mq6-mqjj-c2c5": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads" - }, - "gitea/gitea|GHSA-c3cr-qq9g-666c": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" - }, - "gitea/gitea|GHSA-cp3q-vrj2-ghhh": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents" - }, - "gitea/gitea|GHSA-cwq7-782w-pxcc": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases" - }, - "gitea/gitea|GHSA-f75j-4cw6-rmx4": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`" - }, - "gitea/gitea|GHSA-f8ph-p9p5-vg2p": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unauthenticated artifact-to-repository oracle in raw Actions downloads" - }, - "gitea/gitea|GHSA-fj8v-hjwv-qm88": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)" - }, - "gitea/gitea|GHSA-fq2p-5p22-8g6j": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints" - }, - "gitea/gitea|GHSA-fqjr-23c8-gg9m": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS" - }, - "gitea/gitea|GHSA-fqxf-w92m-prvq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Swift registry per-file 128KiB manifest guard bypassed by aggregation" - }, - "gitea/gitea|GHSA-frpv-2xgv-wxpq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Attachments created before the January 2026 cutoff skip the cross repository check entirely, and permission is then evaluated against the repository named in th" - }, - "gitea/gitea|GHSA-frpw-3h2q-4jj6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs" - }, - "gitea/gitea|GHSA-fw57-jgch-pgf3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests" - }, - "gitea/gitea|GHSA-fx95-gwfc-grgc": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public" - }, - "gitea/gitea|GHSA-fxq4-gr55-7x5g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels" - }, - "gitea/gitea|GHSA-g4hw-fg4c-89mq": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches" - }, - "gitea/gitea|GHSA-g5jj-gp8w-73h7": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccess" - }, - "gitea/gitea|GHSA-gx3v-q759-g323": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface" - }, - "gitea/gitea|GHSA-h2x6-g7q6-344v": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Repository migration SSRF via multi-answer DNS allow-list bypass" - }, - "gitea/gitea|GHSA-h56g-4qw7-2mxg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Public-only API token restriction is not enforced on team API routes" - }, - "gitea/gitea|GHSA-h62v-wmrr-5qjq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Admin repository collaborator can self-escalate to Owner and transfer the repository" - }, - "gitea/gitea|GHSA-hcgw-r9gf-8mph": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories" - }, - "gitea/gitea|GHSA-hch4-r2j8-xm72": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicate" - }, - "gitea/gitea|GHSA-hf55-9cwq-2x64": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs" - }, - "gitea/gitea|GHSA-hxhc-246f-rvqc": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Organization repository creation endpoint skips repository token scope" - }, - "gitea/gitea|GHSA-j2w3-9c3r-g83q": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Private Repository Metadata Remains Accessible After Access Revocation" - }, - "gitea/gitea|GHSA-j72v-mjr6-3424": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)" - }, - "gitea/gitea|GHSA-jj5r-9rpc-8h6h": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti" - }, - "gitea/gitea|GHSA-jr5x-6h83-wrxf": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "REST API exposes organization membership of private organizations to public" - }, - "gitea/gitea|GHSA-m6qc-j894-7h9r": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting" - }, - "gitea/gitea|GHSA-m78w-jjjx-gp8r": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Public-only tokens can read private head repositories via compare and pull request creation (incomplete fix of CVE-2026-58443)" - }, - "gitea/gitea|GHSA-m932-crvm-gcp5": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service" - }, - "gitea/gitea|GHSA-m984-2424-x6vw": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Generic attachment downloads bypass draft-release visibility checks" - }, - "gitea/gitea|GHSA-mf69-7pqq-86vx": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" - }, - "gitea/gitea|GHSA-mg4f-x9v4-6h2p": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes" - }, - "gitea/gitea|GHSA-mw6q-qj47-9g5q": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash" - }, - "gitea/gitea|GHSA-p3pc-g8m5-hrrr": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection" - }, - "gitea/gitea|GHSA-p3rv-cr5f-9gjh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation" - }, - "gitea/gitea|GHSA-p4mj-98mv-xq26": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Private Repository Existence Disclosure via go-get Meta Endpoint" - }, - "gitea/gitea|GHSA-pgqf-926r-548m": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API" - }, - "gitea/gitea|GHSA-pq8x-xpgp-rvmh": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Permissive Git hook directory and script modes may allow local code execution as the Gitea service account" - }, - "gitea/gitea|GHSA-prr9-9mp4-5gp2": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Private org member list leaked via /members API endpoint — incomplete fix for PR #38145" - }, - "gitea/gitea|GHSA-pvjf-7jrm-6w9g": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun" - }, - "gitea/gitea|GHSA-px3q-x2mm-55wg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Package registry: restricted users can read packages of limited-visibility users (authorization bypass)" - }, - "gitea/gitea|GHSA-q423-49rw-g9mh": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private" - }, - "gitea/gitea|GHSA-q55v-4cmj-xh65": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "User-scoped tokens can mint unscoped HTTP signature API credentials" - }, - "gitea/gitea|GHSA-q9pg-jj6x-j9p6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive I" - }, - "gitea/gitea|GHSA-r96c-jc75-rxv6": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea workflow badge bypasses API token scopes" - }, - "gitea/gitea|GHSA-r9ch-mqjm-g67v": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events" - }, - "gitea/gitea|GHSA-rcr6-4jqh-j84m": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Remote Code Execution via diffpatch Git Hook Installation" - }, - "gitea/gitea|GHSA-rfm6-r2x5-cg56": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Restricted users can access limited-visibility users' activity feeds and contribution heatmaps through the API" - }, - "gitea/gitea|GHSA-rgv6-xp99-6mgj": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea Remember-Me Token Theft Not Invalidating Attacker Session" - }, - "gitea/gitea|GHSA-rh79-75qm-gwjr": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Gitea LFS Deploy-Key Privilege Escalation" - }, "gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1445,164 +1552,6 @@ "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" }, - "gitea/gitea|GHSA-v2w8-m4gr-qj65": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "RCE on self-hosted runners | fork-PR approval gate (`NeedApproval`) bypass via job-level concurrency cancellation" - }, - "gitea/gitea|GHSA-v73x-hx65-6pf4": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Unauthorized Access to Labels of Private Organizations" - }, - "gitea/gitea|GHSA-vcp6-2qc6-gvq3": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" - }, - "gitea/gitea|GHSA-vrhc-jjfc-m3m3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)" - }, - "gitea/gitea|GHSA-vvqw-mjq8-x248": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs" - }, - "gitea/gitea|GHSA-vxv2-8j6r-pcpg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)" - }, - "gitea/gitea|GHSA-w4wc-g858-3672": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Restricted users can enumerate limited-visibility organizations via the user org-list API (authorization bypass)" - }, - "gitea/gitea|GHSA-w5pg-649r-p6gg": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag" - }, - "gitea/gitea|GHSA-wg93-gp4m-c6vr": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Restricted users can read limited-visibility users' issue titles and bodies through issue search" - }, - "gitea/gitea|GHSA-wrf9-r3h7-7x5v": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Fork Synchronization Continues After Parent Repository Changes from Public to Private" - }, - "gitea/gitea|GHSA-ww9q-7j5q-hrv5": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Token Scope Bypass on `GET /api/v1/orgs`" - }, - "gitea/gitea|GHSA-wwmh-7r9x-fg49": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Restricted users can read limited-visibility users’ SSH and GPG keys through the API" - }, - "gitea/gitea|GHSA-wx44-9m3m-rjqx": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Locked issues and comments still accept reactions through the web UI" - }, - "gitea/gitea|GHSA-x4q3-gcj3-m6cf": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled" - }, - "gitea/gitea|GHSA-x58h-3mx5-q44r": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Repository migration skips public-only token guard for private repository creation" - }, - "gitea/gitea|GHSA-x77v-q46j-393g": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim" - }, - "gitea/gitea|GHSA-x8c3-3rp8-2j46": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "API team demotion does not reset unit permissions" - }, - "gitea/gitea|GHSA-xfqq-h54g-92f8": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access" - }, - "gitea/gitea|GHSA-xh39-mxw9-34pp": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ" - }, - "gitea/gitea|GHSA-xmfc-hqq8-33wh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "gitea/gitea 1.27.3 (gitea)", - "silent": "first read after the seed", - "summary": "Private profile information leaks on POST request" - }, - "gitea/gitea|GHSA-xmj7-xj85-hfc3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL" - }, - "gitea/gitea|GHSA-xv9x-fj9g-vj6h": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access" - }, - "gitea/gitea|GHSA-xvfh-qwmh-f92w": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "API routes for user social graph, keys, and starred repos bypass private visibility check" - }, - "gitea/gitea|GHSA-xxjv-752h-3vp2": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Public-only repository tokens can update private PR head branches" - }, - "gitea/gitea|release:go-gitea/gitea@v1.27.0": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "gitea/gitea 1.26.2 (gitea-system/gitea.yaml)", - "summary": "Fix: various security fixes ( #38406 ) ( #38426 )" - }, "glanceapp/glance|GHSA-r225-jhr6-68cc": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1860,30 +1809,24 @@ "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share authorization gaps let read-only users delete files" }, - "louislam/uptime-kuma|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", - "summary": "Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "louislam/uptime-kuma 2.5.6 (uptimekuma-system/uptimekuma.yaml)", "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou" }, - "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", - "summary": "⬆️ Security Fixes" - }, "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)", "summary": "⬆️ Security Fixes" }, + "n8nio/n8n|GHSA-2x68-96jw-5r6c": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node" + }, "n8nio/n8n|GHSA-365g-vjw2-grx8": { "first": "2026-10-27", "last_mailed": "2026-10-27", @@ -1891,152 +1834,91 @@ "silent": "first read after the seed", "summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host" }, - "outlinewiki/outline|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "outlinewiki/outline 1.11.0 (outline-system/outline.yaml)", - "summary": "Node.js 26.3.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" + "n8nio/n8n|GHSA-426f-xmcv-g8pg": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback" }, - "outlinewiki/outline|GHSA-cprf-crfh-w3p4": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)" + "n8nio/n8n|GHSA-4v22-g448-h4rg": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "MongoDB Node Update Operations Can Modify Unintended Documents" }, - "outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Authenticated members can publish documents into private collections through a retained parent link" + "n8nio/n8n|GHSA-9p7v-45m2-wxgj": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Deprecated Code Nodes Allow Code Execution in the n8n Main Process" }, - "outlinewiki/outline|GHSA-rq53-m97j-f2pg": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked" + "n8nio/n8n|GHSA-9qx8-fhxv-w794": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Browser Use Upload Tool Reads Arbitrary Files from the n8n Server" }, - "outlinewiki/outline|GHSA-rvj7-2gww-6xfq": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member" + "n8nio/n8n|GHSA-f2cw-9483-7vcp": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Insecure GraphicsMagick Configuration" }, - "outlinewiki/outline|GHSA-x4w3-9p9j-cprh": { - "first": "2026-10-27", - "last_mailed": "2026-10-27", - "program": "outlinewiki/outline 1.10.1 (outline)", - "silent": "first read after the seed", - "summary": "users.update_role reveals whether a user id from another team exists and which role it has" + "n8nio/n8n|GHSA-gx3v-3x3v-f8r5": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Insufficient Isolation in Workflow Expression Evaluation" }, - "outlinewiki/outline|release:outline/outline@v1.12.0": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "outlinewiki/outline 1.10.1 (outline)", - "summary": "1 which fixes multiple recently disclosed vulnerabilities" + "n8nio/n8n|GHSA-jmcg-c7p5-q69g": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments" }, - "redis|GHSA-4c68-q8q8-3g4f": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Out of bound read due to a bug in LUA" + "n8nio/n8n|GHSA-mx4r-96jx-v278": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret" }, - "redis|GHSA-4q32-c38c-pwgq": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Redis DoS Vulnerability due to bad connection error handling" + "n8nio/n8n|GHSA-prmc-fg87-r4gh": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects" }, - "redis|GHSA-5453-q98w-cmvm": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "redis-check-aof may lead to stack overflow and potential RCE" + "n8nio/n8n|GHSA-pwj5-wwm6-g83j": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests" }, - "redis|GHSA-8ghh-qpmp-7826": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Lua Use-After-Free may lead to remote code execution" - }, - "redis|GHSA-93m2-935m-8rj3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Use-After-Free in unblock client flow may lead to remote code execution" - }, - "redis|GHSA-c8h9-259x-jff4": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution" - }, - "redis|GHSA-m8fj-85cg-7vhp": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Lua library commands may lead to integer overflow and potential RCE" - }, - "redis|GHSA-prpq-rh5h-46g9": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Denial-of-service due to malformed ACL selectors" - }, - "redis|GHSA-qrv7-wcrx-q5jp": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Running Lua function as a different user" - }, - "redis|GHSA-r67f-p999-2gff": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client" - }, - "redis|GHSA-rp2m-q4j6-gr43": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Out of bounds write in hyperloglog commands leads to RCE" - }, - "redis|release:redis/redis@8.10.3": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "redis 8.10.2 (plantit-system/plantit.yaml)", - "summary": "Update urgency: SECURITY: There is a security fix in the release" + "n8nio/n8n|GHSA-rc3w-8jc8-7x3w": { + "first": "2026-10-29", + "last_mailed": "2026-10-29", + "program": "n8nio/n8n 2.44.7 (n8n)", + "summary": "Open Redirect via MCP OAuth Dynamic Client Registration" }, "rommapp/romm|CVE-2026-111497": { "first": "2026-10-28", "last_mailed": "2026-10-28", "program": "rommapp/romm 5.4.0 (arcade-system/romm.yaml)", "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" - }, - "rommapp/romm|release:rommapp/romm@5.4.1": { - "first": "2026-10-26", - "last_mailed": "2026-10-26", - "program": "rommapp/romm 5.3.1 (romm)", - "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible" - }, - "vabene1111/recipes|CVE-2026-111497": { - "first": "2026-10-28", - "last_mailed": "2026-10-28", - "program": "vabene1111/recipes 2.6.15 (tandoor-system/tandoor.yaml)", - "summary": "Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process" } }, "failures": { - "registry:docker.io": { - "mailed": true, - "streak": 2 - }, - "runtime": { + "github": { "mailed": false, "streak": 1 + }, + "registry:docker.io": { + "mailed": true, + "streak": 3 + }, + "runtime": { + "mailed": true, + "streak": 2 } }, "runtime_cache": { @@ -2053,23 +1935,6 @@ "python": null, "unchecked": [] }, - "sha256:0250d9cb0d745a8d768f31d3cdc68ac14bfa8b43dedfe0f550158e3861c12db7": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:00724fc1f511635e3675538a326915474d486fcc9409a8b0f574da543e5980a1", - "dpkg": { - "libbrotli1": "1.1.0-2+b7", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u4" - }, - "env": { - "PYTHON_VERSION": "3.13.15" - }, - "node": null, - "python": "3.13.15", - "unchecked": [] - }, "sha256:03295f95a6290e752641f9553ac4198b0e5b71b879d57f7b2371b98f608feb54": { "apk": { "brotli-libs": "1.2.0-r1", @@ -2134,23 +1999,6 @@ "python": null, "unchecked": [] }, - "sha256:09b5aacb0b23e5bff5e09dc87211f64b5beb82010107a1f63f121e343f4c6bf3": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:9855801a896b636f697a49c86f14192ac9fd4fe883a0da90d3f8f86761aab756", - "dpkg": { - "libbrotli1": "1.0.9-2+b6", - "python3": "3.11.2-1+b1", - "python3.11": "3.11.2-6+deb12u9" - }, - "env": { - "PYTHON_VERSION": "3.15.2" - }, - "node": null, - "python": "3.15.2", - "unchecked": [] - }, "sha256:0cefaabd882e42bcb2a2f3dc56d3ce4770560ba62fd7f197f1a2e008fd5731ab": { "apk": {}, "brotli": null, @@ -2214,21 +2062,6 @@ "python": null, "unchecked": [] }, - "sha256:186694f07bb1d6449efbebbd3efb1ec09b476732e77eb80618afb96fa35c5da4": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:39289781f568f61a710f9ebbf734750d3f7eab7635d7cc962d893fb983d39cdb", - "dpkg": { - "libbrotli1": "1.1.0-2+b7", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" - }, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:19764751d501495b021530c9426f25d8f9f8748dc38ab3ba48eb62d7df2cd92e": { "apk": {}, "brotli": null, @@ -2242,6 +2075,19 @@ "python": null, "unchecked": [] }, + "sha256:19c5c09184458a41b7b5915e71463a39f36cd33540f41bdbed008791b8182d5f": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:f1c9e802a0b9de6f64ef8d3e3d3aac4283f250e0a8ff5ebd170d791811431c99", + "dpkg": {}, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:19ea2b669945d842dadc3d500f2d6a795866a003330f59a47b9634658bae98bb": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2294,6 +2140,22 @@ "python": "3.13.15", "unchecked": [] }, + "sha256:1b6d43c3c0f5d2888aa564d9daf29883212b79ad496f59f3c684c099eb1a57b9": { + "apk": { + "brotli-libs": "1.2.1-r0", + "nodejs": "24.22.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:04468a89f352846bc6e584aa173a94f992011da590e730253e7905e212ca4eda", + "dpkg": {}, + "env": { + "PYTHON_VERSION": "3.14.10" + }, + "node": "24.22.1", + "python": "3.14.10", + "unchecked": [] + }, "sha256:1c5789b93bfe5eed0b7287255782d9177027b255de2b22b59f511a693a48db04": { "apk": {}, "brotli": null, @@ -2321,19 +2183,6 @@ "python": null, "unchecked": [] }, - "sha256:1f7ecf094d54363014636c3540dbe9c368394504abaa283914e4fcf8d699f331": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:7cdfce0cbaec91b166bf61f7fafa1199f7b71c8e2c42a3ac1a44279c56ad0d10", - "dpkg": {}, - "env": { - "NODE_VERSION": "22.23.3" - }, - "node": "22.23.3", - "python": null, - "unchecked": [] - }, "sha256:1feaaf724694d08a1fb19370b6ff37e6669edb16cae69e02660177253f903dc1": { "apk": {}, "brotli": null, @@ -2358,6 +2207,17 @@ "python": null, "unchecked": [] }, + "sha256:21090af93f8324db2f0f0f4f38a7c60369d47d917e000c3423d89d2ae2883537": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:be7c1cada5a6eb1656adfa2635b99296af725881301b21f84f35a71fac072c7f", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:23ddf8660087d6b9f5dbdca2ca09817b84db45cb2d9d6e2e0176e70f514629e7": { "apk": { "brotli-libs": "1.1.0-r2" @@ -2371,6 +2231,19 @@ "python": null, "unchecked": [] }, + "sha256:23f4dfbb69ce76315dbc4de7915504f1c2dcecd7ca2648113a493a385972e133": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": "1.2.1", + "brotlicffi": null, + "digest": "sha256:21935614df6d9f24f680a1ef749f0570d2d6b7936c606c0a44253ae875865c04", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:24645e971da6bb1a1f953d6859e307a0b29be1e8b4130a35b3220c209b5b860c": { "apk": {}, "brotli": null, @@ -2397,22 +2270,6 @@ "python": null, "unchecked": [] }, - "sha256:25e8a0eb39f45c9ac5e8e7615fd84a0380018ea012317bc665b86458d900b4b9": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:eed3001be168d4c20e6a4b0087cca33bae98c5107b93a641d94980de09b6f8ee", - "dpkg": { - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" - }, - "env": { - "NODE_VERSION": "26.9.0" - }, - "node": "26.9.0", - "python": null, - "unchecked": [] - }, "sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b": { "apk": {}, "brotli": null, @@ -2424,6 +2281,19 @@ "python": null, "unchecked": [] }, + "sha256:28a627c1e2a568ea8c2d3fd83861675fdd3d8327a09f5a245c399b4864ad5ceb": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:8a66d1c70f95d205fbaa24628bbe39d9a3fbce72c1d740d744e57076bfc92396", + "dpkg": {}, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6": { "apk": {}, "brotli": null, @@ -2451,13 +2321,24 @@ "python": "3.13.15", "unchecked": [] }, - "sha256:2fdeeb1a2028ce7cb1274696237e32b9f849e16b6d77314d08c78356a6016fca": { + "sha256:2f8d7f29c2a473dce8e84b1a33ac3a692a21238c39b6757fa0e0162542d85865": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:772f52a394c99f6c6a8d11cbb6e3e4e834e64e9755320c3a0300bbe6c2b984a3", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, + "sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504": { "apk": { "brotli-libs": "1.2.0-r1" }, "brotli": null, "brotlicffi": null, - "digest": "sha256:9ecfcc16092957520389b4955d6eb5a2ef2b59bc054e5ef39e4d5de3cc731956", + "digest": "sha256:d154aee25ff14e9545e3e32ccbcf0c1bfd5654d12fb513f52d242e9202687d32", "dpkg": {}, "env": {}, "node": null, @@ -2580,6 +2461,19 @@ "python": null, "unchecked": [] }, + "sha256:4195f6c405e40230cd10c0770425cf500c1f542a96e9f6584c11649c150e5a89": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:55ae0a036e785c662c7197b830058b246a11624b7041438e32dbab610be45a3f", + "dpkg": {}, + "env": { + "NODE_VERSION": "22.23.4" + }, + "node": "22.23.4", + "python": null, + "unchecked": [] + }, "sha256:43cd93b9e1f02d760923f67f6e74e1c4d4a9cccb9b08fa42ad60770333f231eb": { "apk": { "brotli-libs": "1.1.0-r1" @@ -2606,19 +2500,6 @@ "python": null, "unchecked": [] }, - "sha256:4538137bc5af902dece165f2bf73776d9cf4eafb6dd714670724af8f3eb77764": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:499fbe958fa4a0c93172a231c14898986556bb28bd5cd569a0f41dbf887b04d7", - "dpkg": {}, - "env": { - "NODE_VERSION": "22.18.0" - }, - "node": "22.18.0", - "python": null, - "unchecked": [] - }, "sha256:46d90e46bd87312fcbbbb05036d99e4cb1c821e928b0516ee727de4c3c90752b": { "apk": { "brotli-libs": "1.1.0-r2" @@ -2632,17 +2513,6 @@ "python": null, "unchecked": [] }, - "sha256:47b08295737773de3b711fb86f13ae802f5074e96a9a2d29f5f80164ac08c046": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:be7c1cada5a6eb1656adfa2635b99296af725881301b21f84f35a71fac072c7f", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:47e961a569fd52ff31f0fe205ed91eeab17d9f5fff6722e6d7ea6b588748b293": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2656,6 +2526,21 @@ "python": null, "unchecked": [] }, + "sha256:485d546a2e31d6a8b4db8423fcba5c109de8c218d93410af115fd1ccfc4352a6": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1ab81816384ce8e782fdbdb2b7703ab68fd12442bc311a53118dc0d74c2ced24", + "dpkg": { + "libbrotli1": "1.1.0-2+b7" + }, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:48e36b608b461273b9dae857725cd0561a127f2c694b687318f6d0c5ce63e5c9": { "apk": { "brotli-libs": "1.2.0-r1" @@ -2727,14 +2612,18 @@ "python": null, "unchecked": [] }, - "sha256:51ee22428b4192f4372b54f84c8b90cd710311ad99993c5045f53b51717dd3f7": { + "sha256:515c072ea1cf82ece3503f301fdf75dd5a7148abcc8fa10aaefd5ec56643b703": { "apk": {}, "brotli": null, "brotlicffi": null, - "digest": "sha256:db459d08b5f3b900e9a646920e58c1087497a9f070f9142ed8f0fca8e81b1350", - "dpkg": {}, + "digest": "sha256:e881320833451d8320727d7e20386c39021d51ba03bbb1e153ddfeb114ce6145", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1", + "python3": "3.13.5-1", + "python3.13": "3.13.5-2+deb13u5" + }, "env": {}, - "node": "26.3.0", + "node": null, "python": null, "unchecked": [] }, @@ -2803,33 +2692,6 @@ "python": null, "unchecked": [] }, - "sha256:589e3606b11b61c3fa2d9661832cb73645a9b93a9cc7d807a071e2bc6c584498": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:b29c63de16524ac92971b465a0487cd396bd7c7498d1a2c01440ac42aac818e6", - "dpkg": { - "libbrotli1": "1.1.0-2+b7", - "nodejs": "20.19.2+dfsg-1+deb13u3", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" - }, - "env": {}, - "node": "20.19.2", - "python": null, - "unchecked": [] - }, - "sha256:591974a7cb92be1d30a9033da0b97ef628d0ee1328e3ec29683b0075619805ba": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:27e97da27f1581e8e134009230d6bc2ec62757fda13d23095ebcb349f935a702", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:599b99bbae1a297fa8169734cf9267dc97c330f5c9abd21ebdaab32869c9a42c": { "apk": {}, "brotli": "1.2.0", @@ -2858,6 +2720,19 @@ "python": null, "unchecked": [] }, + "sha256:5b28c9352c8374b8a1ed96fbdd8d6755fea6e43510ec43fdf6538aa02ea40f56": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1270449e47e1fcd703661c4d728b7904d89aacfb715662c26116cc9dd73f266b", + "dpkg": {}, + "env": { + "PYTHON_VERSION": "3.13.16" + }, + "node": null, + "python": "3.13.16", + "unchecked": [] + }, "sha256:5e00373854247750cc3e4479b492ae09293ff5e06ed10177f226634d97888679": { "apk": {}, "brotli": "1.2.0", @@ -2913,6 +2788,21 @@ "python": null, "unchecked": [] }, + "sha256:69ae5315c618b7c14c1af3e34c6e211acdb231793af424ecd1cab0b70691d987": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:7d7ae59b924b6b58e018f2a67aa7207519ef0625ead5306a2491f982b6f89886", + "dpkg": { + "libbrotli1": "1.0.9-2+b6" + }, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:6aa7d9832324ea403be144a26398a82afbf04abbb4da89f9d04ba61838516b3f": { "apk": { "brotli-libs": "1.2.0-r1" @@ -3010,6 +2900,19 @@ "python": null, "unchecked": [] }, + "sha256:785835ea65db4bba6f021acc0f3be91b0fef76a53fe41f8588c6698d2aed0606": { + "apk": { + "brotli-libs": "1.2.0-r1" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:2db7d28517d1fba17c2da3210395f7be11a11b419246ad0da2edf782af72f367", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc": { "apk": {}, "brotli": null, @@ -3081,6 +2984,36 @@ "python": null, "unchecked": [] }, + "sha256:845a67373a9f9e62b88e5f9067867202200d63db3615a051acbd77b09e86b9ce": { + "apk": {}, + "brotli": "1.2.1", + "brotlicffi": null, + "digest": "sha256:6370400609d402ff673be82dd78c1f624f6df67ce40d383b487acb2686fa288b", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1" + }, + "env": { + "PYTHON_VERSION": "3.14.10" + }, + "node": null, + "python": "3.14.10", + "unchecked": [] + }, + "sha256:849f63732d3e751f077c1567bda77aebc68c8b5691271cb418e10efbcf2f364f": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1b5c37484eafc983fdcffa08596d941f63a9942a02de8cd5c6f697036cbc4d7c", + "dpkg": {}, + "env": { + "NODE_VERSION": "22.23.4" + }, + "node": "22.23.4", + "python": null, + "unchecked": [] + }, "sha256:860fa4baed04ae1c235de870edab0c8006227546dea1bbb6411fbfc5e27cf1db": { "apk": { "brotli-libs": "1.1.0-r2" @@ -3094,16 +3027,17 @@ "python": null, "unchecked": [] }, - "sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef": { + "sha256:8677fb7b81b1d3db20b849e989a1dadc2a11159e51eb34a2acdcb01102274edf": { "apk": { - "brotli-libs": "1.2.0-r1" + "brotli-libs": "1.2.1-r0", + "nodejs": "24.18.1-r0" }, "brotli": null, "brotlicffi": null, - "digest": "sha256:d584940b7143982682ac4541509dd628506c2b568221e6af41e5a2ead1de4fe7", + "digest": "sha256:923a808be529a834a171b3e045821aeb7e2851f4b6fc9514076785b68a9142f6", "dpkg": {}, "env": {}, - "node": null, + "node": "24.18.1", "python": null, "unchecked": [] }, @@ -3133,17 +3067,6 @@ "python": null, "unchecked": [] }, - "sha256:89c1ea91e897f0fe0a3731595330bc45b8bdef4047464a07116f891a94054b31": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:1e1a22175fbf1b32157ddaf0219e1db4e5401fab2b94ed285add64d18587cd2d", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:8a0ef97527544baa2b35825940ddf4db6e2d09c30cd5aa31fd269ff604cc8b75": { "apk": {}, "brotli": null, @@ -3155,21 +3078,6 @@ "python": null, "unchecked": [] }, - "sha256:8ae3cdf8cdbba2ac98754e9fc4ccec67bbaa86b6e6ab1ccf9683ddcff85eee72": { - "apk": { - "brotli-libs": "1.2.0-r0" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:280421e740e660db04c5c907810a01cb1a53becbefbf8dda2f0e0bb7edeceaca", - "dpkg": {}, - "env": { - "NODE_VERSION": "24.21.0" - }, - "node": "24.21.0", - "python": null, - "unchecked": [] - }, "sha256:8c45e21f95875ccd35a6e68f7da72504df9e837d6ee703379512cb8de6a67082": { "apk": {}, "brotli": null, @@ -3187,21 +3095,6 @@ "python": "3.13.18", "unchecked": [] }, - "sha256:8e2fe9beeefc55a02f6e1d04cad0fc3c22e8f067d309188f016551dc99ec27b3": { - "apk": {}, - "brotli": "1.2.0", - "brotlicffi": null, - "digest": "sha256:8f7c95941bcc560ea4ddd9ac27142698000e1abf08ac43d709828e712f71a4ea", - "dpkg": { - "libbrotli1": "1.1.0-2+b7" - }, - "env": { - "PYTHON_VERSION": "3.14.7" - }, - "node": null, - "python": "3.14.7", - "unchecked": [] - }, "sha256:92bfd78d731e254ba64f62b77b0696add6447a33642ee5feda106a26b285aa7f": { "apk": { "brotli-libs": "1.2.0-r1", @@ -3363,32 +3256,6 @@ "python": "3.11.14", "unchecked": [] }, - "sha256:a281cb44176dbe5323e0f7ea2d6fd34d58914a3a8525c36437a086d1d7c4fef8": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:7512ade4f436688782c85e07da559fc3af73e80ed568f674fda11c960a2e9d02", - "dpkg": {}, - "env": { - "NODE_VERSION": "26.4.0" - }, - "node": "26.4.0", - "python": null, - "unchecked": [] - }, - "sha256:a3554c0d0b48177b1413c26e01f695334428020d9df01243fbae3e11cfd17417": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:2db7d28517d1fba17c2da3210395f7be11a11b419246ad0da2edf782af72f367", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:a3c0482c5d55155a3aa96c4cbb63d2aa379f02ae3bbeb76909ffed2b15980f36": { "apk": {}, "brotli": null, @@ -3402,6 +3269,17 @@ "python": null, "unchecked": [] }, + "sha256:a46257e06c82ad85242d0d38077d0a52d9896389ca60a1a59d3463db586e5fa4": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:a469ea076d4a1b4b1d86a41d130f2f536cd9da996a2b1fb39c0d7635f9d89b9a": { "apk": {}, "brotli": null, @@ -3480,21 +3358,6 @@ "python": null, "unchecked": [] }, - "sha256:b069e4307dec06ea06d16989c6861c30a1ff208568be44ed5fb5d422cd3e950c": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:3d57623bf031f32a0597a3ebe0cd869bff6ba181c02ebc90fac492458bcfd4a4", - "dpkg": { - "libbrotli1": "1.0.9-2+b6" - }, - "env": { - "NODE_VERSION": "24.18.1" - }, - "node": "24.18.1", - "python": null, - "unchecked": [] - }, "sha256:b09d9b21381f47a79b3cbcb30da25266dc17186ea00ae65e99fdc51396f48e70": { "apk": { "brotli-libs": "1.2.0-r1", @@ -3559,6 +3422,23 @@ "python": null, "unchecked": [] }, + "sha256:b97b63f7b64698bebb0651b6a5842d33f4493a6902291d36acc5a768e383b950": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:e79bc58043116e8190135cd6d0214ffcf185ce53248ad2b15598133b63e044e5", + "dpkg": { + "libbrotli1": "1.0.9-2+deb12u1", + "python3": "3.11.2-1+b1", + "python3.11": "3.11.2-6+deb12u9" + }, + "env": { + "PYTHON_VERSION": "3.15.2" + }, + "node": null, + "python": "3.15.2", + "unchecked": [] + }, "sha256:ba7bd45b8177fec7a31d297ecaf3c98e94aabb4fc043f167df35aeba8b93468c": { "apk": {}, "brotli": null, @@ -3594,21 +3474,6 @@ "python": null, "unchecked": [] }, - "sha256:c124b9ad3452f46061b5054607d26ea51730dae5372c5e469920063ba2bc6dcc": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:8aa2821993207ae840ce09e4223217efcd14e01f71525db734faf4232bd59999", - "dpkg": { - "libbrotli1": "1.1.0-2+b7", - "python3": "3.13.5-1", - "python3.13": "3.13.5-2+deb13u5" - }, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:c15bff75068effb03f4355997d03dc7e0fc58720c2b54ad6f7f10d1bc57efaa5": { "apk": {}, "brotli": null, @@ -3648,6 +3513,21 @@ "python": null, "unchecked": [] }, + "sha256:c65ecfe613b539ac74c62a4c3b2c27e8f8a6076384c8f27e8a3c0f3be17cc385": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:5bbe76a31abbe0f1449d7820e550131c020b097c24d3bcfc5ad1231779982c1c", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1", + "python3": "3.13.5-1", + "python3.13": "3.13.5-2+deb13u5" + }, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:c6c7ae1d5dfdcb094ad344ed68ccffc26635c9c6be80965664c33baf064b0515": { "apk": {}, "brotli": null, @@ -3685,6 +3565,21 @@ "python": null, "unchecked": [] }, + "sha256:cb3769f50a5887e38d678ab466656bd2a56f3ce96bc8a4d0788cc479d19c05c9": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:2d296a60e77354eb1c0c0e2f6470da2a12775c88fc89d15bb5fe020d1b2f71f6", + "dpkg": {}, + "env": { + "NODE_VERSION": "24.22.1" + }, + "node": "24.22.1", + "python": null, + "unchecked": [] + }, "sha256:cdcb7b1c7b6f1c9cb9442c71ac6275e78184657448407b2c1fdde7ee8024f4fb": { "apk": {}, "brotli": null, @@ -3707,6 +3602,19 @@ "python": null, "unchecked": [] }, + "sha256:d1f596a35332ad04d8a69d88a5e19bc82acd47f2bc2fe687dd2145b1ef5a8b19": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:eba88ca674fa7a02581cf246d74d0122d92d3f19276f76dcfdfde06bca88dd29", + "dpkg": {}, + "env": { + "NODE_VERSION": "26.12.1" + }, + "node": "26.12.1", + "python": null, + "unchecked": [] + }, "sha256:d200d2dd76b03a99b52651fd1325aff7dcd35422c35c01bac56571b0507f3deb": { "apk": {}, "brotli": null, @@ -3718,21 +3626,6 @@ "python": null, "unchecked": [] }, - "sha256:d317916b28090c33eb36b308464ea391f8b7df1d850fcfea227a39ec879718c2": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:04225d8995a221de3b73a6131fe25eed14448830e54998f30877a70f48c6ac13", - "dpkg": { - "libbrotli1": "1.1.0-2+b7" - }, - "env": { - "NODE_VERSION": "24.21.0" - }, - "node": "24.21.0", - "python": null, - "unchecked": [] - }, "sha256:d4057e7019e9b19f25e039d4a204cc502e1a112d1a2305966a534f3d7079e644": { "apk": {}, "brotli": null, @@ -3772,21 +3665,6 @@ "python": null, "unchecked": [] }, - "sha256:d76177573caab135e8167179c9954168b5c582a48cbef0fcb7e1571af0c84d98": { - "apk": { - "brotli-libs": "1.2.0-r1" - }, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:aa7226cab445342c5271844424663c59cdd635af5ccde63e4e3a362662fa86bf", - "dpkg": {}, - "env": { - "NODE_VERSION": "22.23.1" - }, - "node": "22.23.1", - "python": null, - "unchecked": [] - }, "sha256:d8fab675b55ad293ded98fd71efcfd46054cbad9746534ae1cc4794a88c0b3be": { "apk": {}, "brotli": null, @@ -3800,6 +3678,32 @@ "python": null, "unchecked": [] }, + "sha256:d9385242202ae385a5d8064f41a59a0b58218399e60e7e499d2a6afb449bc304": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:35c2ec2ed7aa8f141c182038c1cde16f24947f3e9dac6cb31d4ba81b4f9ea26c", + "dpkg": { + "libbrotli1": "1.1.0-2+deb13u1" + }, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, + "sha256:da6324232770050b7d5f6222e8f4e223f1c688363b02ebb3c15a7546dd7133d5": { + "apk": { + "brotli-libs": "1.2.1-r0" + }, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:b7c7030d23f421ec2a64cd16f505ec315d1ed66ce9870bd2c1c4513e38282e28", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f": { "apk": { "brotli-libs": "1.2.0-r1" @@ -3824,19 +3728,6 @@ "python": null, "unchecked": [] }, - "sha256:e16c2f166a8174901959fdf85e2e4c7bd1ebc4b37e0b6655de97c41408a260c4": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:7909f11a1ce217ed660afb02545f26e4adf72a5282633db436972abdfa026d20", - "dpkg": {}, - "env": { - "PYTHON_VERSION": "3.11.15" - }, - "node": null, - "python": "3.11.15", - "unchecked": [] - }, "sha256:e3da62a847b9a5d51a11f73cfea1d9c13c3be3809614490d4edddcf01dcf919b": { "apk": {}, "brotli": null, @@ -3962,6 +3853,17 @@ "python": null, "unchecked": [] }, + "sha256:f6b08b09a05725f9431502d3b5714f5c4576e82c1a84fa1debe0c24a7e0c3ec4": { + "apk": {}, + "brotli": null, + "brotlicffi": null, + "digest": "sha256:1e1a22175fbf1b32157ddaf0219e1db4e5401fab2b94ed285add64d18587cd2d", + "dpkg": {}, + "env": {}, + "node": null, + "python": null, + "unchecked": [] + }, "sha256:f7dc8428d10aef17f3075886d3c1c022f566ec456f88985f02c137f4fc534576": { "apk": {}, "brotli": null, @@ -4001,17 +3903,6 @@ "python": null, "unchecked": [] }, - "sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e": { - "apk": {}, - "brotli": null, - "brotlicffi": null, - "digest": "sha256:f97baa533a26513c453a362be331a43eb60214302f449c16571b23cea141dce4", - "dpkg": {}, - "env": {}, - "node": null, - "python": null, - "unchecked": [] - }, "sha256:fea863d0cd9ec445985d9c75fc6ed64e38a1d2766cf0c250a33d553f4fc1b771": { "apk": {}, "brotli": null,