From ed843da7887a9bfed5d48cce60930fc69e31153b Mon Sep 17 00:00:00 2001
From: felhom security watch <monitoring@felhom.eu>
Date: Mon, 26 Oct 2026 22:44:04 +0000
Subject: [PATCH] security-watch: memory of 2026-10-26 (R-1303). Docs only.

---
 documentation/security-watch/state.json | 895 ++++++++++++++++++++++++
 1 file changed, 895 insertions(+)
 create mode 100644 documentation/security-watch/state.json

diff --git a/documentation/security-watch/state.json b/documentation/security-watch/state.json
new file mode 100644
index 00000000..45b05bc1
--- /dev/null
+++ b/documentation/security-watch/state.json
@@ -0,0 +1,895 @@
+{
+ "advisories": {
+  "cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
+   "summary": "8 eMudhra certificates are compromised. Here's what you need to know"
+  },
+  "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.4:VULN-176088": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
+   "summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server"
+  },
+  "codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
+   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
+  },
+  "codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
+   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
+  },
+  "codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
+   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
+  },
+  "codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
+   "summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
+  },
+  "codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
+   "summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
+  },
+  "codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
+   "summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
+  },
+  "docmost/docmost|release:docmost/docmost@v0.97.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "docmost/docmost 0.96.0 (docmost)",
+   "summary": "This release includes security fixes for the latest Node"
+  },
+  "f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Stored XSS in SVG Hotlinks"
+  },
+  "f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "File Request MaxSize Limit Bypassed in File Request"
+  },
+  "f0rc3/gokapi|GHSA-4xg4-54hm-9j77": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Stored XSS vulnerability in friendly name for API keys"
+  },
+  "f0rc3/gokapi|GHSA-95rc-wc32-gm53": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Stored XSS by uploading file with malicious file name"
+  },
+  "f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Data Leak in Upload Status Stream"
+  },
+  "f0rc3/gokapi|GHSA-hcff-qv74-7hr4": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "CSRF in Login Endpoint"
+  },
+  "f0rc3/gokapi|GHSA-j6jp-78w8-34x6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Privilege Escalation in File Replace"
+  },
+  "f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Privilege escalation with auth token"
+  },
+  "f0rc3/gokapi|GHSA-q658-hfpg-35qc": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion"
+  },
+  "f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "f0rc3/gokapi v1.9.6 (gokapi)",
+   "summary": "DoS in API endpoint"
+  },
+  "fallenbagel/jellyseerr|GHSA-8j73-j6rc-q8xh": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Third-party notification credentials of other users exposed via request detail endpoints"
+  },
+  "fallenbagel/jellyseerr|GHSA-f7xw-jcqr-57hp": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials"
+  },
+  "fallenbagel/jellyseerr|GHSA-gx3h-3jg5-q65f": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Missing authentication on pushSubscription endpoints"
+  },
+  "fallenbagel/jellyseerr|GHSA-mc6w-69r3-62h8": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Path traversal to RCE via /avatarproxy image cache filename from upstream ETag"
+  },
+  "fallenbagel/jellyseerr|GHSA-rc4w-7m3r-c2f7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint"
+  },
+  "fallenbagel/jellyseerr|GHSA-xc6j-6p6h-p799": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
+   "summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
+  },
+  "flomp/wanderer-db|GHSA-332v-mq7g-5hqf": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
+  },
+  "flomp/wanderer-db|GHSA-3xp7-7492-j2q6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
+  },
+  "flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
+  },
+  "flomp/wanderer-db|GHSA-fprh-3pp9-68m9": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
+  },
+  "flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
+  },
+  "flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
+  },
+  "flomp/wanderer-db|GHSA-vj82-xj83-jp85": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
+  },
+  "flomp/wanderer-db|GHSA-vprp-gr6m-j375": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
+  },
+  "flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
+  },
+  "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )"
+  },
+  "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-db v0.20.0 (wanderer)",
+   "summary": "( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )"
+  },
+  "flomp/wanderer-web|GHSA-332v-mq7g-5hqf": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
+  },
+  "flomp/wanderer-web|GHSA-3xp7-7492-j2q6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
+  },
+  "flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
+  },
+  "flomp/wanderer-web|GHSA-fprh-3pp9-68m9": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
+  },
+  "flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
+  },
+  "flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
+  },
+  "flomp/wanderer-web|GHSA-vj82-xj83-jp85": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
+  },
+  "flomp/wanderer-web|GHSA-vprp-gr6m-j375": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
+  },
+  "flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
+  },
+  "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "Inbound ActivityPub deliveries are now authenticated between the  web  and  db  services ( GHSA-mr29-2qg5-m4fw , PR  #1205 )"
+  },
+  "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "flomp/wanderer-web v0.20.0 (wanderer)",
+   "summary": "( GHSA-fprh-3pp9-68m9 , thanks  @zer0d4y5 )"
+  },
+  "freikin/dawarich|release:Freika/dawarich@1.17.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "freikin/dawarich 1.15.3 (dawarich)",
+   "summary": "js 20 package, which no longer receives upstream security fixes"
+  },
+  "ghcr.io/advplyr/audiobookshelf|release:advplyr/audiobookshelf@v2.37.2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)",
+   "summary": "1 (October 2026 security release)"
+  },
+  "ghcr.io/alam00000/bentopdf|GHSA-5xjf-rr5x-pcfj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
+   "summary": "SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass"
+  },
+  "ghcr.io/alam00000/bentopdf|GHSA-cx8x-7rrr-r9x8": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
+   "summary": "Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests"
+  },
+  "ghcr.io/alam00000/bentopdf|GHSA-wh78-rcw2-hhg9": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
+   "summary": "SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker"
+  },
+  "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
+   "summary": "Warning  This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 ,  GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including  v2"
+  },
+  "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
+   "summary": "Warning  This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 ,  GHSA-5xjf-rr5x-pcfj ,  GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and "
+  },
+  "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.68.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
+   "summary": "Update dependency nodemailer to v10 [SECURITY] by  @renovate [bot] in  #798"
+  },
+  "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.69.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
+   "summary": "org/en/blog/vulnerability/october-2026-security-releases"
+  },
+  "ghcr.io/home-assistant/home-assistant|GHSA-jff5-5j3g-vhqc": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)",
+   "summary": "Actions expression injection in `helpers/version/action.yml`"
+  },
+  "ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
+   "summary": "One-click account takeover via XSS in login page continue redirect"
+  },
+  "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
+   "summary": "com/ ) as well as some  nodejs security patches"
+  },
+  "ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
+   "summary": "One-click account takeover via XSS in login page continue redirect"
+  },
+  "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
+   "summary": "com/ ) as well as some  nodejs security patches"
+  },
+  "ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
+   "summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV"
+  },
+  "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
+   "summary": "1 for its October security release ( #3196 )"
+  },
+  "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
+   "summary": "This is a security release on top of 0"
+  },
+  "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "summary": "Security Issues Patched"
+  },
+  "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.1": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
+   "summary": "Warning  This release is a security release to patch a NodeJS upstream vulnerability"
+  },
+  "ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
+   "summary": "fixed  shopping list bulk API endpoint accepted IDs from foreign spaces  GHSA-5p9v-743w-79h3"
+  },
+  "grafana/grafana|release:grafana/grafana@v13.2.4": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "grafana/grafana 13.2.3 (grafana)",
+   "summary": "Security: Fix  CVE-2026-15577"
+  },
+  "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Moving or renaming a folder retargets public shares to the whole folder"
+  },
+  "gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
+  },
+  "gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
+  },
+  "gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
+  },
+  "gtstef/filebrowser|GHSA-4v62-884x-2466": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
+  },
+  "gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
+  },
+  "gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
+  },
+  "gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
+  },
+  "gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
+  },
+  "gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
+  },
+  "gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Logout Bypass via Alternate JWT Spelling"
+  },
+  "gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
+  },
+  "gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
+  },
+  "gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Read-only users can overwrite files through PUT /api/resources"
+  },
+  "gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
+  },
+  "gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
+  },
+  "gtstef/filebrowser|GHSA-cw65-p35p-633w": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
+  },
+  "gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
+  },
+  "gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Custom API token with no global caps inherits owner admin access"
+  },
+  "gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
+  },
+  "gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
+  },
+  "gtstef/filebrowser|GHSA-p93p-v944-4p44": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
+  },
+  "gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
+  },
+  "gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
+  },
+  "gtstef/filebrowser|GHSA-qv53-4557-m65h": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
+  },
+  "gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
+  },
+  "gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
+  },
+  "gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
+  },
+  "gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
+  },
+  "gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
+  },
+  "gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
+  },
+  "gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
+  },
+  "gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
+  },
+  "gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "Share authorization gaps let read-only users delete files"
+  },
+  "gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.7-stable": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "[High] TOTP re-enrollment via  POST /api/auth/otp/generate  and  POST /api/auth/otp/verify  no longer allows anonymous callers to replace an existing second fac"
+  },
+  "gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.8-stable": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
+   "summary": "[High] TOTP re-enrollment via  POST /api/auth/otp/generate  and  POST /api/auth/otp/verify  no longer allows anonymous callers to replace an existing second fac"
+  },
+  "jellyfin/jellyfin|GHSA-4vx8-xhc9-qg6x": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": " Broken access control in session remote-control API"
+  },
+  "jellyfin/jellyfin|GHSA-6828-c7cx-hvqm": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": " Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories"
+  },
+  "jellyfin/jellyfin|GHSA-9x85-gx46-6522": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": "Potential IDOR in playlist management"
+  },
+  "jellyfin/jellyfin|GHSA-c39p-cgf8-866g": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": "Potential path transversal exposure in PluginsController.cs"
+  },
+  "jellyfin/jellyfin|GHSA-cf3c-8m59-2vhx": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": "Memory exhaustion and SSRF via external references in user-supplied SVG images"
+  },
+  "jellyfin/jellyfin|GHSA-hw73-62vp-9gxf": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
+   "summary": "Potential path transversal exposure in HlsSegmentController.cs"
+  },
+  "louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
+   "summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
+  },
+  "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
+   "summary": "⬆️ Security Fixes"
+  },
+  "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
+   "summary": "⬆️ Security Fixes"
+  },
+  "louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
+   "summary": "⬆️ Security Fixes"
+  },
+  "lscr.io/linuxserver/bookstack|release:BookStackApp/BookStack@v26.09.2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lscr.io/linuxserver/bookstack 26.09.1 (bookstack)",
+   "summary": "Security Release"
+  },
+  "lscr.io/linuxserver/code-server|release:coder/code-server@v4.141.1": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lscr.io/linuxserver/code-server 4.129.0 (code-server)",
+   "summary": "Brotli decoder ( CVE-2026-111497 )"
+  },
+  "lukevella/rallly|GHSA-gmq4-f8j5-8w8q": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lukevella/rallly 4.15.3 (rallly)",
+   "summary": "Remote code execution in poll preview images via vulnerable Next.js next/og"
+  },
+  "lukevella/rallly|release:lukevella/rallly@v4.15.4": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lukevella/rallly 4.15.3 (rallly)",
+   "summary": "🔒 Critical security fix: remote code execution in poll preview images"
+  },
+  "lukevella/rallly|release:lukevella/rallly@v4.15.5": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lukevella/rallly 4.15.3 (rallly)",
+   "summary": "🔒 Security fix: denial of service through Server Actions"
+  },
+  "lukevella/rallly|release:lukevella/rallly@v4.16.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lukevella/rallly 4.15.3 (rallly)",
+   "summary": "The Control Panel tells you when an update is available and whether it fixes a security issue"
+  },
+  "lukevella/rallly|release:lukevella/rallly@v4.16.2": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "lukevella/rallly 4.15.3 (rallly)",
+   "summary": "js security update"
+  },
+  "outlinewiki/outline|release:outline/outline@v1.12.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "outlinewiki/outline 1.10.1 (outline)",
+   "summary": "1 which fixes multiple recently disclosed  vulnerabilities"
+  },
+  "privatebin/pdo|release:PrivateBin/PrivateBin@2.1.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "privatebin/pdo 2.0.6 (privatebin)",
+   "summary": "More details on this issue can be found in the security advisory:"
+  },
+  "rommapp/romm|release:rommapp/romm@5.4.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "summary": "0 [security] by  @renovate [bot] in  #4966"
+  },
+  "rommapp/romm|release:rommapp/romm@5.4.1": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "rommapp/romm 5.3.1 (romm)",
+   "summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
+  },
+  "traefik|GHSA-28hp-c82p-8vqj": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret"
+  },
+  "traefik|GHSA-53qr-784g-cj35": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients"
+  },
+  "traefik|GHSA-cw35-4q88-3rmp": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another"
+  },
+  "traefik|GHSA-fh26-gfpp-7xxx": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)"
+  },
+  "traefik|GHSA-hrpp-p4fc-wwf8": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients"
+  },
+  "traefik|GHSA-mhjw-hmjv-p99x": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams"
+  },
+  "traefik|GHSA-mwrr-6hp4-pxr6": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route"
+  },
+  "traefik|GHSA-p8wx-ph99-xgcr": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation"
+  },
+  "traefik|GHSA-qm9f-w54v-q2qh": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool"
+  },
+  "traefik|GHSA-qvj7-gq9c-hp7q": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth"
+  },
+  "traefik|GHSA-rv2h-qh7j-xrjw": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA"
+  },
+  "traefik|GHSA-ww7c-q3mv-xx22": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process"
+  },
+  "traefik|release:traefik/traefik@v3.7.14": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Advisory  GHSA-53qr-784g-cj35"
+  },
+  "traefik|release:traefik/traefik@v3.7.15": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Advisory  GHSA-p8wx-ph99-xgcr"
+  },
+  "traefik|release:traefik/traefik@v3.7.16": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "traefik v3.7.13 (controller infra)",
+   "summary": "Advisory  GHSA-hrpp-p4fc-wwf8"
+  },
+  "vikunja/vikunja|release:go-vikunja/vikunja@v2.7.0": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "summary": "🔒 Six security fixes"
+  },
+  "vikunja/vikunja|release:go-vikunja/vikunja@v2.7.1": {
+   "first": "2026-10-26",
+   "last_mailed": "2026-10-26",
+   "program": "vikunja/vikunja 2.6.0 (vikunja)",
+   "summary": "🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes"
+  }
+ },
+ "failures": {},
+ "seed_pending": [
+  "actualbudget/actual-server",
+  "calcom/cal.com",
+  "deluan/navidrome",
+  "freikin/dawarich",
+  "getmeili/meilisearch",
+  "ghcr.io/alexta69/metube",
+  "ghcr.io/diced/zipline",
+  "ghcr.io/gethomepage/homepage",
+  "ghcr.io/lukegus/termix",
+  "ghcr.io/mealie-recipes/mealie",
+  "ghcr.io/paperless-ngx/paperless-ngx",
+  "ghcr.io/papra-hq/papra",
+  "ghcr.io/sysadminsmedia/homebox",
+  "ghcr.io/tandoorrecipes/recipes",
+  "ghost",
+  "gitea/gitea",
+  "glanceapp/glance",
+  "gotson/komga",
+  "grafana/grafana",
+  "lscr.io/linuxserver/bookstack",
+  "lscr.io/linuxserver/code-server",
+  "lscr.io/linuxserver/prowlarr",
+  "lscr.io/linuxserver/radarr",
+  "lscr.io/linuxserver/sabnzbd",
+  "lscr.io/linuxserver/transmission",
+  "n8nio/n8n",
+  "nginx",
+  "outlinewiki/outline",
+  "privatebin/pdo",
+  "rommapp/romm",
+  "vaultwarden/server",
+  "vikunja/vikunja",
+  "wger/server"
+ ],
+ "seeded_at": "2026-10-26",
+ "version": 1,
+ "weekly_last": "2026-10-26"
+}