{ "advisories": { "calcom/cal.com|GHSA-cpf2-q635-xrwx": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "calcom/cal.com v6.2.0 (calcom)", "silent": "first read after the seed", "summary": "Not expiring old sessions after enabling 2FA" }, "calcom/cal.com|GHSA-p3f6-52gv-cj7m": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "calcom/cal.com v6.2.0 (calcom)", "silent": "first read after the seed", "summary": "Repository takeover via `.github/workflows/pr.yml`" }, "cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "cloudflare/cloudflared 2026.10.3 (controller infra)", "summary": "8 eMudhra certificates are compromised. Here's what you need to know" }, "cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.4:VULN-176088": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "cloudflare/cloudflared 2026.10.3 (controller infra)", "summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server" }, "docmost/docmost|release:docmost/docmost@v0.97.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "docmost/docmost 0.96.0 (docmost)", "summary": "This release includes security fixes for the latest Node" }, "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "flomp/wanderer-db v0.20.0 (wanderer)", "summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )" }, "flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "flomp/wanderer-db v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "flomp/wanderer-web v0.20.0 (wanderer)", "summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )" }, "flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "flomp/wanderer-web v0.20.0 (wanderer)", "summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )" }, "freikin/dawarich|release:Freika/dawarich@1.17.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "freikin/dawarich 1.15.3 (dawarich)", "summary": "js 20 package, which no longer receives upstream security fixes" }, "ghcr.io/advplyr/audiobookshelf|release:advplyr/audiobookshelf@v2.37.2": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)", "summary": "1 (October 2026 security release)" }, "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)", "summary": "Warning This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 , GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including v2" }, "ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.7": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)", "summary": "Warning This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 , GHSA-5xjf-rr5x-pcfj , GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and " }, "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.68.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)", "summary": "Update dependency nodemailer to v10 [SECURITY] by @renovate [bot] in #798" }, "ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.69.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)", "summary": "org/en/blog/vulnerability/october-2026-security-releases" }, "ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)", "silent": "first read after the seed", "summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints" }, "ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)", "summary": "com/ ) as well as some nodejs security patches" }, "ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)", "summary": "com/ ) as well as some nodejs security patches" }, "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", "summary": "1 for its October security release ( #3196 )" }, "ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)", "summary": "This is a security release on top of 0" }, "ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Cross-user nested automation execution bypasses ownership checks and runs actions with victim privileges" }, "ghcr.io/lukegus/termix|GHSA-6gr3-r7jx-wfmh": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Two-factor authentication can be bypassed via a forged client-supplied device identifier" }, "ghcr.io/lukegus/termix|GHSA-7j7m-85p4-2cpm": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Authentication Bypass by Spoofing and Improper Restriction of Excessive Authentication Attempts in Termix" }, "ghcr.io/lukegus/termix|GHSA-fj9w-vcj9-66qh": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Termix: the automation `run_command` step substitutes untrusted template values straight into a shell command, ignoring the quoting contract its own template mo" }, "ghcr.io/lukegus/termix|GHSA-frx8-qqgg-7j7g": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Termix Desktop: any website can obtain a session on the embedded backend (CORS allows all origins + passwordless loopback auto-session)" }, "ghcr.io/lukegus/termix|GHSA-hmv7-25x4-vp6w": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Termix: a read-only session-share guest can delete its own participant record and then type into the owner's live SSH session, turning a \"watch only\" link into " }, "ghcr.io/lukegus/termix|GHSA-j7j4-82wh-3vj5": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "LDAPS certificate validation is disabled, allowing MITM capture of LDAP and user credentials" }, "ghcr.io/lukegus/termix|GHSA-r7x4-j6x8-jxrx": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Authenticated users can mint Guacamole tokens for arbitrary RDP/VNC/Telnet targets" }, "ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft" }, "ghcr.io/lukegus/termix|GHSA-rgf3-2q88-q4wp": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Cross-User File Manager SSH Session Termination and State Replacement" }, "ghcr.io/lukegus/termix|GHSA-v3vp-ffww-q7pw": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "Credential disclosure vulnerability in Termix" }, "ghcr.io/lukegus/termix|GHSA-wv2p-5jqw-9qf3": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/lukegus/termix 2.8.0 (termix)", "silent": "first read after the seed", "summary": "User-controlled Vault address is fetched without SSRF controls" }, "ghcr.io/mealie-recipes/mealie|GHSA-99wf-32rc-2767": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/mealie-recipes/mealie v3.28.0 (mealie)", "silent": "first read after the seed", "summary": "Recipe zip import lets a user take over another group's tools and read another group's recipes" }, "ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", "silent": "first read after the seed", "summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled" }, "ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)", "silent": "first read after the seed", "summary": "Cross-user information disclosure in AI classification workflows on ownerless documents" }, "ghcr.io/sysadminsmedia/homebox|GHSA-4gp5-59x3-vhhg": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": " Homebox generic notifier SSRF via HTTP redirect after URL validation" }, "ghcr.io/sysadminsmedia/homebox|GHSA-4p8r-vm9v-c9pm": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay" }, "ghcr.io/sysadminsmedia/homebox|GHSA-58m4-m8xj-v3j2": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Unauthenticated /api/v1/users/register lacks rate limiting while Argon2id runs per request (default-enabled) — resource exhaustion DoS" }, "ghcr.io/sysadminsmedia/homebox|GHSA-59cq-p2m6-hh23": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "API keys are not revoked on password change and never expire by default, so a leaked key survives full credential rotation" }, "ghcr.io/sysadminsmedia/homebox|GHSA-754m-5j7m-8wfv": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Unauthenticated X-Forwarded-Host injection into /swagger/doc.json lets an attacker control the host of the served OpenAPI spec (host-header injection / cache po" }, "ghcr.io/sysadminsmedia/homebox|GHSA-g3p9-jfjj-pqgw": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "No Mechanism to Revoke Other Active Sessions on Login or Logout, Allowing Persistent Stolen-Token Access" }, "ghcr.io/sysadminsmedia/homebox|GHSA-h7wm-wjr6-cfxh": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "CSV formula injection in entities export and bill-of-materials export" }, "ghcr.io/sysadminsmedia/homebox|GHSA-j935-m3f2-frrj": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "EntityRepository.UpdateByGroup mutates custom Fields on another tenant's item — outer entity update is group-scoped, but the Fields create/update/delete block i" }, "ghcr.io/sysadminsmedia/homebox|GHSA-jm28-2xm3-m6m5": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Group members can rename, delete, and take over groups they don't own" }, "ghcr.io/sysadminsmedia/homebox|GHSA-mw9p-fhpj-jf82": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Invitation usage limit is raceable, oversubscribing a group beyond the owner-granted quota in Homebox" }, "ghcr.io/sysadminsmedia/homebox|GHSA-rhfm-x4x2-p3qr": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "SSRF via generic:// notifier with insecure defaults allows authenticated users to reach localhost and internal network services" }, "ghcr.io/sysadminsmedia/homebox|GHSA-wxcf-4p4j-vhvg": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Cross-Tenant IDOR in Entity Update Endpoint Leaks Full Entity Data Across Group Boundaries" }, "ghcr.io/sysadminsmedia/homebox|GHSA-xqg9-6xxv-3452": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "silent": "first read after the seed", "summary": "Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service" }, "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "summary": "Security Issues Patched" }, "ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.1": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)", "summary": "Warning This release is a security release to patch a NodeJS upstream vulnerability" }, "ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Recipe import subsystem: XXE local file read via lxml default parser (rezeptsuitede/Cookmate XML importers) and SSRF in the pestle importer left out of the GHSA" }, "ghcr.io/tandoorrecipes/recipes|GHSA-5p9v-743w-79h3": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Shopping-list bulk create accepts foreign-Space Food/Unit/Ingredient IDs and returns their names" }, "ghcr.io/tandoorrecipes/recipes|GHSA-69q3-5q6x-7hmx": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Group-Permission Cache Key Omits Active Space" }, "ghcr.io/tandoorrecipes/recipes|GHSA-748x-xc8h-95hj": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "User can move an owned entry into another user’s unshared recipe book" }, "ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Any user can read other spaces' meal plans via mealplan_id on shopping list entries" }, "ghcr.io/tandoorrecipes/recipes|GHSA-cqj3-64qw-4w52": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints" }, "ghcr.io/tandoorrecipes/recipes|GHSA-pcq2-64qw-jm4x": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Private recipe overview disclosed through ShoppingListRecipe API in 2.6.15" }, "ghcr.io/tandoorrecipes/recipes|GHSA-vc5c-xh64-79vp": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Fix for GHSA-5mw3-c978-gc6w checks UserSpace ids against User ids" }, "ghcr.io/tandoorrecipes/recipes|GHSA-xq7g-9q95-vjc6": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "silent": "first read after the seed", "summary": "Server-Side Request Forgery (SSRF) in Pestle Recipe Import" }, "ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)", "summary": "fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3" }, "gitea/gitea|GHSA-467c-4w7p-8427": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Algorithmic Complexity DoS in Issue Reference Parsing" }, "gitea/gitea|GHSA-469m-x4mw-38r3": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "OAuth access tokens can be exchanged as refresh tokens" }, "gitea/gitea|GHSA-4j4g-m7mr-hp5j": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency" }, "gitea/gitea|GHSA-4jmf-h2cm-hg7w": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`" }, "gitea/gitea|GHSA-54w9-6cc5-9wj9": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false" }, "gitea/gitea|GHSA-6f9g-7jgm-m5ph": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS" }, "gitea/gitea|GHSA-6g2h-xpg3-rm48": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings" }, "gitea/gitea|GHSA-6pv5-8rp7-8c75": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one" }, "gitea/gitea|GHSA-7769-9pr9-m24h": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Deploy keys impersonate the repository owner in the hook pipeline" }, "gitea/gitea|GHSA-7cq7-4v93-8wjm": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)" }, "gitea/gitea|GHSA-7v5j-mph8-9w6g": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller" }, "gitea/gitea|GHSA-8hhh-mqpg-jpxc": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy" }, "gitea/gitea|GHSA-8j56-f865-gqq2": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Draft releases include attachment metadata from other repositories" }, "gitea/gitea|GHSA-8pwg-hcgm-54cp": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup" }, "gitea/gitea|GHSA-93pj-3x56-5gc2": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cancelled fork-PR Actions jobs are revived by later approval" }, "gitea/gitea|GHSA-94rx-fqm6-q23v": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Stored XSS via Repository Media API" }, "gitea/gitea|GHSA-96qg-qxxj-r8xq": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments" }, "gitea/gitea|GHSA-9h7g-h754-c8x2": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification" }, "gitea/gitea|GHSA-c3cr-qq9g-666c": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users" }, "gitea/gitea|GHSA-cwq7-782w-pxcc": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases" }, "gitea/gitea|GHSA-fqjr-23c8-gg9m": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS" }, "gitea/gitea|GHSA-fx95-gwfc-grgc": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public" }, "gitea/gitea|GHSA-fxq4-gr55-7x5g": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels" }, "gitea/gitea|GHSA-g4hw-fg4c-89mq": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches" }, "gitea/gitea|GHSA-hcgw-r9gf-8mph": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories" }, "gitea/gitea|GHSA-hf55-9cwq-2x64": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs" }, "gitea/gitea|GHSA-jj5r-9rpc-8h6h": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti" }, "gitea/gitea|GHSA-mf69-7pqq-86vx": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Cross-Session OpenID Credential Linking Enables Account Takeover" }, "gitea/gitea|GHSA-mw6q-qj47-9g5q": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash" }, "gitea/gitea|GHSA-p3pc-g8m5-hrrr": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection" }, "gitea/gitea|GHSA-p3rv-cr5f-9gjh": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation" }, "gitea/gitea|GHSA-pvjf-7jrm-6w9g": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun" }, "gitea/gitea|GHSA-rqhx-647v-wx32": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "SSRF via HTTP Redirect in Repository Migration" }, "gitea/gitea|GHSA-vcp6-2qc6-gvq3": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys" }, "gitea/gitea|GHSA-vvqw-mjq8-x248": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs" }, "gitea/gitea|GHSA-wx44-9m3m-rjqx": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Locked issues and comments still accept reactions through the web UI" }, "gitea/gitea|GHSA-x4q3-gcj3-m6cf": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled" }, "gitea/gitea|GHSA-x8c3-3rp8-2j46": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "API team demotion does not reset unit permissions" }, "gitea/gitea|GHSA-xfqq-h54g-92f8": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access" }, "gitea/gitea|GHSA-xh39-mxw9-34pp": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ" }, "gitea/gitea|GHSA-xmfc-hqq8-33wh": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "gitea/gitea 1.27.3 (gitea)", "silent": "first read after the seed", "summary": "Private profile information leaks on POST request" }, "glanceapp/glance|GHSA-r225-jhr6-68cc": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "glanceapp/glance v0.8.5 (glance)", "silent": "first read after the seed", "summary": "Unauthenticated login requests can cause unbounded memory consumption" }, "grafana/grafana|GHSA-2x6g-h2hg-rq84": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Email addresses and usernames can not be trusted" }, "grafana/grafana|GHSA-4724-7jwc-3fpw": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Spoofing originalUrl of snapshots" }, "grafana/grafana|GHSA-8wjh-59cw-9xh4": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Forward OAuth Identity Token can allow users to access some data sources" }, "grafana/grafana|GHSA-8xmm-x63g-f6xv": { "first": "2026-10-27", "last_mailed": "2026-10-27", "program": "grafana/grafana 13.2.3 (grafana)", "silent": "first read after the seed", "summary": "Stored XSS in ResourcePicker component " }, "grafana/grafana|release:grafana/grafana@v13.2.4": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "grafana/grafana 13.2.3 (grafana)", "summary": "Security: Fix CVE-2026-15577" }, "gtstef/filebrowser|GHSA-26fh-r34c-qxh6": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Moving or renaming a folder retargets public shares to the whole folder" }, "gtstef/filebrowser|GHSA-3846-gh75-gp3m": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)" }, "gtstef/filebrowser|GHSA-3j46-5w28-f8p2": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write" }, "gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Duplicate finder can show another user’s restricted file names from a shared cache" }, "gtstef/filebrowser|GHSA-4v62-884x-2466": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback" }, "gtstef/filebrowser|GHSA-4vrc-935w-xxq2": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical" }, "gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`" }, "gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting" }, "gtstef/filebrowser|GHSA-6gr6-5qpq-888p": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum" }, "gtstef/filebrowser|GHSA-8655-2ph3-q7q7": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled" }, "gtstef/filebrowser|GHSA-8m35-wcjh-95q7": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Logout Bypass via Alternate JWT Spelling" }, "gtstef/filebrowser|GHSA-9fcr-gm58-p839": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors" }, "gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer" }, "gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Read-only users can overwrite files through PUT /api/resources" }, "gtstef/filebrowser|GHSA-c84q-q5g6-r47f": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)" }, "gtstef/filebrowser|GHSA-c9cr-w724-gqj3": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin" }, "gtstef/filebrowser|GHSA-cw65-p35p-633w": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)" }, "gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)" }, "gtstef/filebrowser|GHSA-gfgm-886h-6r47": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Custom API token with no global caps inherits owner admin access" }, "gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory" }, "gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions" }, "gtstef/filebrowser|GHSA-p93p-v944-4p44": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission" }, "gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS" }, "gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Archive download follows symlinks out of source scope (arbitrary file read)" }, "gtstef/filebrowser|GHSA-qv53-4557-m65h": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key" }, "gtstef/filebrowser|GHSA-qx86-4v5r-26g5": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)" }, "gtstef/filebrowser|GHSA-r744-4vm3-2px3": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas" }, "gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN" }, "gtstef/filebrowser|GHSA-rqqq-wv83-rp74": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope" }, "gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": { "first": "2026-10-26", "last_mailed": "2026-10-26", "program": "gtstef/filebrowser 1.5.6-stable (controller infra)", "summary": " Stored XSS via HTML Preview — `