admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bbc3acb817f13f7bf3a4121abd9f00b58fd6e842
felhom.eu/documentation/security-watch/state.json
T

1650 lines
72 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"advisories": {
"calcom/cal.com|GHSA-cpf2-q635-xrwx": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "calcom/cal.com v6.2.0 (calcom)",
"silent": "first read after the seed",
"summary": "Not expiring old sessions after enabling 2FA"
},
"calcom/cal.com|GHSA-p3f6-52gv-cj7m": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "calcom/cal.com v6.2.0 (calcom)",
"silent": "first read after the seed",
"summary": "Repository takeover via `.github/workflows/pr.yml`"
},
"cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
"summary": "8 eMudhra certificates are compromised. Here's what you need to know"
},
"cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.4:VULN-176088": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
"summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server"
},
"docmost/docmost|release:docmost/docmost@v0.97.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "docmost/docmost 0.96.0 (docmost)",
"summary": "This release includes security fixes for the latest Node"
},
"flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
"summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )"
},
"flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
},
"flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
"summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )"
},
"flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
},
"freikin/dawarich|release:Freika/dawarich@1.17.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "freikin/dawarich 1.15.3 (dawarich)",
"summary": "js 20 package, which no longer receives upstream security fixes"
},
"ghcr.io/advplyr/audiobookshelf|release:advplyr/audiobookshelf@v2.37.2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)",
"summary": "1 (October 2026 security release)"
},
"ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
"summary": "Warning This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 , GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including v2"
},
"ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.7": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
"summary": "Warning This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 , GHSA-5xjf-rr5x-pcfj , GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and "
},
"ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.68.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
"summary": "Update dependency nodemailer to v10 [SECURITY] by @renovate [bot] in #798"
},
"ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.69.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
"summary": "org/en/blog/vulnerability/october-2026-security-releases"
},
"ghcr.io/gethomepage/homepage|GHSA-669x-4pg4-w24r": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/gethomepage/homepage v1.13.2 (homepage)",
"silent": "first read after the seed",
"summary": "Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints"
},
"ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
"summary": "com/ ) as well as some nodejs security patches"
},
"ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
"summary": "com/ ) as well as some nodejs security patches"
},
"ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
"summary": "1 for its October security release ( #3196 )"
},
"ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
"summary": "This is a security release on top of 0"
},
"ghcr.io/lukegus/termix|GHSA-3q2m-5r5p-w45r": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Cross-user nested automation execution bypasses ownership checks and runs actions with victim privileges"
},
"ghcr.io/lukegus/termix|GHSA-6gr3-r7jx-wfmh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Two-factor authentication can be bypassed via a forged client-supplied device identifier"
},
"ghcr.io/lukegus/termix|GHSA-7j7m-85p4-2cpm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Authentication Bypass by Spoofing and Improper Restriction of Excessive Authentication Attempts in Termix"
},
"ghcr.io/lukegus/termix|GHSA-fj9w-vcj9-66qh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Termix: the automation `run_command` step substitutes untrusted template values straight into a shell command, ignoring the quoting contract its own template mo"
},
"ghcr.io/lukegus/termix|GHSA-frx8-qqgg-7j7g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Termix Desktop: any website can obtain a session on the embedded backend (CORS allows all origins + passwordless loopback auto-session)"
},
"ghcr.io/lukegus/termix|GHSA-hmv7-25x4-vp6w": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Termix: a read-only session-share guest can delete its own participant record and then type into the owner's live SSH session, turning a \"watch only\" link into "
},
"ghcr.io/lukegus/termix|GHSA-j7j4-82wh-3vj5": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "LDAPS certificate validation is disabled, allowing MITM capture of LDAP and user credentials"
},
"ghcr.io/lukegus/termix|GHSA-r7x4-j6x8-jxrx": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Authenticated users can mint Guacamole tokens for arbitrary RDP/VNC/Telnet targets"
},
"ghcr.io/lukegus/termix|GHSA-r9gw-3w87-mhh7": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Improper certificate validation in Electron desktop client enables MITM credential/token theft"
},
"ghcr.io/lukegus/termix|GHSA-rgf3-2q88-q4wp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Cross-User File Manager SSH Session Termination and State Replacement"
},
"ghcr.io/lukegus/termix|GHSA-v3vp-ffww-q7pw": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "Credential disclosure vulnerability in Termix"
},
"ghcr.io/lukegus/termix|GHSA-wv2p-5jqw-9qf3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/lukegus/termix 2.8.0 (termix)",
"silent": "first read after the seed",
"summary": "User-controlled Vault address is fetched without SSRF controls"
},
"ghcr.io/mealie-recipes/mealie|GHSA-99wf-32rc-2767": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/mealie-recipes/mealie v3.28.0 (mealie)",
"silent": "first read after the seed",
"summary": "Recipe zip import lets a user take over another group's tools and read another group's recipes"
},
"ghcr.io/paperless-ngx/paperless-ngx|GHSA-2jhj-xqrq-rmrq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
"silent": "first read after the seed",
"summary": "Path traversal in filename generation when `FILENAME_FORMAT_REMOVE_NONE` enabled"
},
"ghcr.io/paperless-ngx/paperless-ngx|GHSA-c8f3-pqr2-rr24": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/paperless-ngx/paperless-ngx 2.20.15 (paperless-ngx)",
"silent": "first read after the seed",
"summary": "Cross-user information disclosure in AI classification workflows on ownerless documents"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-4gp5-59x3-vhhg": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": " Homebox generic notifier SSRF via HTTP redirect after URL validation"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-4p8r-vm9v-c9pm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-58m4-m8xj-v3j2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Unauthenticated /api/v1/users/register lacks rate limiting while Argon2id runs per request (default-enabled) — resource exhaustion DoS"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-59cq-p2m6-hh23": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "API keys are not revoked on password change and never expire by default, so a leaked key survives full credential rotation"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-754m-5j7m-8wfv": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Unauthenticated X-Forwarded-Host injection into /swagger/doc.json lets an attacker control the host of the served OpenAPI spec (host-header injection / cache po"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-g3p9-jfjj-pqgw": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "No Mechanism to Revoke Other Active Sessions on Login or Logout, Allowing Persistent Stolen-Token Access"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-h7wm-wjr6-cfxh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "CSV formula injection in entities export and bill-of-materials export"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-j935-m3f2-frrj": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "EntityRepository.UpdateByGroup mutates custom Fields on another tenant's item — outer entity update is group-scoped, but the Fields create/update/delete block i"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-jm28-2xm3-m6m5": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Group members can rename, delete, and take over groups they don't own"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-mw9p-fhpj-jf82": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Invitation usage limit is raceable, oversubscribing a group beyond the owner-granted quota in Homebox"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-rhfm-x4x2-p3qr": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "SSRF via generic:// notifier with insecure defaults allows authenticated users to reach localhost and internal network services"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-wxcf-4p4j-vhvg": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Cross-Tenant IDOR in Entity Update Endpoint Leaks Full Entity Data Across Group Boundaries"
},
"ghcr.io/sysadminsmedia/homebox|GHSA-xqg9-6xxv-3452": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"silent": "first read after the seed",
"summary": "Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service"
},
"ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"summary": "Security Issues Patched"
},
"ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.1": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
"summary": "Warning This release is a security release to patch a NodeJS upstream vulnerability"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-5f74-7rgh-pc97": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Recipe import subsystem: XXE local file read via lxml default parser (rezeptsuitede/Cookmate XML importers) and SSRF in the pestle importer left out of the GHSA"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-5p9v-743w-79h3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Shopping-list bulk create accepts foreign-Space Food/Unit/Ingredient IDs and returns their names"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-69q3-5q6x-7hmx": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Group-Permission Cache Key Omits Active Space"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-748x-xc8h-95hj": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "User can move an owned entry into another user’s unshared recipe book"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-c7mc-c9jr-38hf": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Any user can read other spaces' meal plans via mealplan_id on shopping list entries"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-cqj3-64qw-4w52": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Private recipe file and share-link authorization bypass in recipe utility API endpoints"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-pcq2-64qw-jm4x": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Private recipe overview disclosed through ShoppingListRecipe API in 2.6.15"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-vc5c-xh64-79vp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Fix for GHSA-5mw3-c978-gc6w checks UserSpace ids against User ids"
},
"ghcr.io/tandoorrecipes/recipes|GHSA-xq7g-9q95-vjc6": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"silent": "first read after the seed",
"summary": "Server-Side Request Forgery (SSRF) in Pestle Recipe Import"
},
"ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
"summary": "fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3"
},
"gitea/gitea|GHSA-467c-4w7p-8427": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Algorithmic Complexity DoS in Issue Reference Parsing"
},
"gitea/gitea|GHSA-469m-x4mw-38r3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "OAuth access tokens can be exchanged as refresh tokens"
},
"gitea/gitea|GHSA-4j4g-m7mr-hp5j": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Unapproved fork PR cancels trusted in-progress runs via run-level concurrency"
},
"gitea/gitea|GHSA-4jmf-h2cm-hg7w": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`"
},
"gitea/gitea|GHSA-54w9-6cc5-9wj9": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false"
},
"gitea/gitea|GHSA-6f9g-7jgm-m5ph": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS"
},
"gitea/gitea|GHSA-6g2h-xpg3-rm48": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings"
},
"gitea/gitea|GHSA-6pv5-8rp7-8c75": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one"
},
"gitea/gitea|GHSA-7769-9pr9-m24h": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Deploy keys impersonate the repository owner in the hook pipeline"
},
"gitea/gitea|GHSA-7cq7-4v93-8wjm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)"
},
"gitea/gitea|GHSA-7v5j-mph8-9w6g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Push-mirror API checks local-path permission on the repository owner instead of the caller"
},
"gitea/gitea|GHSA-8hhh-mqpg-jpxc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy"
},
"gitea/gitea|GHSA-8j56-f865-gqq2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Draft releases include attachment metadata from other repositories"
},
"gitea/gitea|GHSA-8pwg-hcgm-54cp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Built-in SSH server auth bypass via case-insensitive LIKE key lookup"
},
"gitea/gitea|GHSA-93pj-3x56-5gc2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Cancelled fork-PR Actions jobs are revived by later approval"
},
"gitea/gitea|GHSA-94rx-fqm6-q23v": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Stored XSS via Repository Media API"
},
"gitea/gitea|GHSA-96qg-qxxj-r8xq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments"
},
"gitea/gitea|GHSA-9h7g-h754-c8x2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification"
},
"gitea/gitea|GHSA-c3cr-qq9g-666c": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users"
},
"gitea/gitea|GHSA-cwq7-782w-pxcc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases"
},
"gitea/gitea|GHSA-fqjr-23c8-gg9m": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS"
},
"gitea/gitea|GHSA-fx95-gwfc-grgc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public"
},
"gitea/gitea|GHSA-fxq4-gr55-7x5g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels"
},
"gitea/gitea|GHSA-g4hw-fg4c-89mq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches"
},
"gitea/gitea|GHSA-hcgw-r9gf-8mph": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories"
},
"gitea/gitea|GHSA-hf55-9cwq-2x64": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs"
},
"gitea/gitea|GHSA-jj5r-9rpc-8h6h": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenti"
},
"gitea/gitea|GHSA-mf69-7pqq-86vx": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Cross-Session OpenID Credential Linking Enables Account Takeover"
},
"gitea/gitea|GHSA-mw6q-qj47-9g5q": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Uncaught Exception and Out-of-bounds Read results in Gitea crash"
},
"gitea/gitea|GHSA-p3pc-g8m5-hrrr": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection"
},
"gitea/gitea|GHSA-p3rv-cr5f-9gjh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation"
},
"gitea/gitea|GHSA-pvjf-7jrm-6w9g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun"
},
"gitea/gitea|GHSA-rqhx-647v-wx32": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "SSRF via HTTP Redirect in Repository Migration"
},
"gitea/gitea|GHSA-vcp6-2qc6-gvq3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "VerifyCert maps SSH certificate principals onto other users' SSH public keys"
},
"gitea/gitea|GHSA-vvqw-mjq8-x248": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs"
},
"gitea/gitea|GHSA-wx44-9m3m-rjqx": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Locked issues and comments still accept reactions through the web UI"
},
"gitea/gitea|GHSA-x4q3-gcj3-m6cf": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"
},
"gitea/gitea|GHSA-x8c3-3rp8-2j46": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "API team demotion does not reset unit permissions"
},
"gitea/gitea|GHSA-xfqq-h54g-92f8": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": " Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access"
},
"gitea/gitea|GHSA-xh39-mxw9-34pp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull requ"
},
"gitea/gitea|GHSA-xmfc-hqq8-33wh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "gitea/gitea 1.27.3 (gitea)",
"silent": "first read after the seed",
"summary": "Private profile information leaks on POST request"
},
"glanceapp/glance|GHSA-r225-jhr6-68cc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "glanceapp/glance v0.8.5 (glance)",
"silent": "first read after the seed",
"summary": "Unauthenticated login requests can cause unbounded memory consumption"
},
"grafana/grafana|GHSA-2x6g-h2hg-rq84": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "grafana/grafana 13.2.3 (grafana)",
"silent": "first read after the seed",
"summary": "Email addresses and usernames can not be trusted"
},
"grafana/grafana|GHSA-4724-7jwc-3fpw": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "grafana/grafana 13.2.3 (grafana)",
"silent": "first read after the seed",
"summary": "Spoofing originalUrl of snapshots"
},
"grafana/grafana|GHSA-8wjh-59cw-9xh4": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "grafana/grafana 13.2.3 (grafana)",
"silent": "first read after the seed",
"summary": "Forward OAuth Identity Token can allow users to access some data sources"
},
"grafana/grafana|GHSA-8xmm-x63g-f6xv": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "grafana/grafana 13.2.3 (grafana)",
"silent": "first read after the seed",
"summary": "Stored XSS in ResourcePicker component "
},
"grafana/grafana|release:grafana/grafana@v13.2.4": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "grafana/grafana 13.2.3 (grafana)",
"summary": "Security: Fix CVE-2026-15577"
},
"gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Moving or renaming a folder retargets public shares to the whole folder"
},
"gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
},
"gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
},
"gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
},
"gtstef/filebrowser|GHSA-4v62-884x-2466": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
},
"gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
},
"gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
},
"gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
},
"gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
},
"gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
},
"gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Logout Bypass via Alternate JWT Spelling"
},
"gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
},
"gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
},
"gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Read-only users can overwrite files through PUT /api/resources"
},
"gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
},
"gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
},
"gtstef/filebrowser|GHSA-cw65-p35p-633w": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
},
"gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
},
"gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Custom API token with no global caps inherits owner admin access"
},
"gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
},
"gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
},
"gtstef/filebrowser|GHSA-p93p-v944-4p44": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
},
"gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
},
"gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
},
"gtstef/filebrowser|GHSA-qv53-4557-m65h": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
},
"gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
},
"gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
},
"gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
},
"gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
},
"gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
},
"gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
},
"gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
},
"gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
},
"gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "Share authorization gaps let read-only users delete files"
},
"gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.7-stable": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac"
},
"gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.8-stable": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
"summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac"
},
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.6": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
"summary": "⬆️ Security Fixes"
},
"lscr.io/linuxserver/bookstack|release:BookStackApp/BookStack@v26.09.2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lscr.io/linuxserver/bookstack 26.09.1 (bookstack)",
"summary": "Security Release"
},
"lscr.io/linuxserver/code-server|release:coder/code-server@v4.141.1": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lscr.io/linuxserver/code-server 4.129.0 (code-server)",
"summary": "Brotli decoder ( CVE-2026-111497 )"
},
"lukevella/rallly|release:lukevella/rallly@v4.15.4": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lukevella/rallly 4.15.3 (rallly)",
"summary": "🔒 Critical security fix: remote code execution in poll preview images"
},
"lukevella/rallly|release:lukevella/rallly@v4.15.5": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lukevella/rallly 4.15.3 (rallly)",
"summary": "🔒 Security fix: denial of service through Server Actions"
},
"lukevella/rallly|release:lukevella/rallly@v4.16.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lukevella/rallly 4.15.3 (rallly)",
"summary": "The Control Panel tells you when an update is available and whether it fixes a security issue"
},
"lukevella/rallly|release:lukevella/rallly@v4.16.2": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "lukevella/rallly 4.15.3 (rallly)",
"summary": "js security update"
},
"n8nio/n8n|GHSA-365g-vjw2-grx8": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Execute Command Node in n8n Allows Authenticated Users to Run Arbitrary Commands on Host"
},
"n8nio/n8n|GHSA-43v8-hjhm-chjp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Chat Hub: chat-only users can register tool types the product already tries to sandbox"
},
"n8nio/n8n|GHSA-65mv-v8rp-54wc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Quick Base Node Allows Filter Injection Through the Where Parameter"
},
"n8nio/n8n|GHSA-8crx-5h96-q72q": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard"
},
"n8nio/n8n|GHSA-8vrr-mgc5-jg55": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value"
},
"n8nio/n8n|GHSA-crfj-5wv6-8v86": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data"
},
"n8nio/n8n|GHSA-m7gv-mpg5-7c9v": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block"
},
"n8nio/n8n|GHSA-mgpr-56r4-5c67": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes"
},
"n8nio/n8n|GHSA-mp7q-23hg-35cf": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting"
},
"n8nio/n8n|GHSA-pcr3-v5vr-qppf": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Per-User Credential Theft via Error-Workflow Execution Context Inheritance"
},
"n8nio/n8n|GHSA-qmvv-q3c9-wpp7": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Credential Secrets Exposed in Execution Error Data of Several Nodes"
},
"n8nio/n8n|GHSA-v9cx-v88r-42vw": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted"
},
"n8nio/n8n|GHSA-wvjj-qg37-pv73": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "n8nio/n8n 2.42.1 (n8n)",
"silent": "first read after the seed",
"summary": "Crafted Workflow ID Gives Access to Data Tables in Other Projects"
},
"outlinewiki/outline|GHSA-27h6-gg7j-wj5w": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Cross-tenant authorization gap in the GitLab integration inbound-webhook handler"
},
"outlinewiki/outline|GHSA-48rq-wx9j-g949": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Account takeover via cross-provider providerId collision in userProvisioner (SSO/OIDC login)"
},
"outlinewiki/outline|GHSA-65xg-84g9-7hrm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Existing collaboration connection remains writable after document archive or deletion"
},
"outlinewiki/outline|GHSA-97vv-f6qq-6842": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Auth-changing routes accept API keys / OAuth tokens (missing AuthenticationType.APP guard) → account takeover & persistence"
},
"outlinewiki/outline|GHSA-cprf-crfh-w3p4": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Email sign-in token has no server-side redemption check (confirmed in code; asymmetric with the sibling code+email flow; live replay not executed)"
},
"outlinewiki/outline|GHSA-f28f-75h4-499q": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Cross-tenant account takeover via unverified Microsoft Graph `mail` attribute in Azure SSO callback"
},
"outlinewiki/outline|GHSA-h6ff-rw9x-5mq2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Authenticated members can publish documents into private collections through a retained parent link"
},
"outlinewiki/outline|GHSA-m9vh-j2wc-xj24": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Pre-auth account takeover via Azure and Discord OAuth adapters trusting unverified email claim (nOAuth-class, shared email-merge primitive in userProvisioner)"
},
"outlinewiki/outline|GHSA-rq53-m97j-f2pg": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Unpublished documents remain publicly accessible and their shares cannot be revoked"
},
"outlinewiki/outline|GHSA-rvj7-2gww-6xfq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Outline: shares.info parent-share discovery leaks private-collection name/path (and ancestor document titles/URLs + sharer identity) to a non-member"
},
"outlinewiki/outline|GHSA-w8vg-8mjx-xq8x": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "Logout-revoked JWTs retain read/write access through existing document collaboration WebSockets"
},
"outlinewiki/outline|GHSA-x4w3-9p9j-cprh": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "outlinewiki/outline 1.10.1 (outline)",
"silent": "first read after the seed",
"summary": "users.update_role reveals whether a user id from another team exists and which role it has"
},
"outlinewiki/outline|release:outline/outline@v1.12.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "outlinewiki/outline 1.10.1 (outline)",
"summary": "1 which fixes multiple recently disclosed vulnerabilities"
},
"privatebin/pdo|GHSA-w873-3ghv-hmh6": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "privatebin/pdo 2.0.6 (privatebin)",
"silent": "first read after the seed",
"summary": "Insufficient Markdown/HTML Sanitization enables Deceptive Popups due to Bootstrap classes"
},
"privatebin/pdo|release:PrivateBin/PrivateBin@2.1.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "privatebin/pdo 2.0.6 (privatebin)",
"summary": "More details on this issue can be found in the security advisory:"
},
"rommapp/romm|GHSA-722m-w9p2-xv2j": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "rommapp/romm 5.3.1 (romm)",
"silent": "first read after the seed",
"summary": "Unauthenticated WebSocket Scan Trigger"
},
"rommapp/romm|GHSA-7jw3-ppmp-57wc": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "rommapp/romm 5.3.1 (romm)",
"silent": "first read after the seed",
"summary": "RomM hidden ROM child routes bypass entity visibility restrictions and allow unauthorized media modification"
},
"rommapp/romm|GHSA-9q83-m866-5jrp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "rommapp/romm 5.3.1 (romm)",
"silent": "first read after the seed",
"summary": "RomM Public Save Download Endpoint Bypasses Hidden ROM Visibility and Leaks Protected Save Files"
},
"rommapp/romm|GHSA-q7fg-rj3q-m3gm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "rommapp/romm 5.3.1 (romm)",
"silent": "first read after the seed",
"summary": "Any user can read and download other users' private collections and Favourites via `/api/roms` collection filters"
},
"rommapp/romm|release:rommapp/romm@5.4.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "rommapp/romm 5.3.1 (romm)",
"summary": "0 [security] by @renovate [bot] in #4966"
},
"rommapp/romm|release:rommapp/romm@5.4.1": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "rommapp/romm 5.3.1 (romm)",
"summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
},
"traefik|GHSA-28hp-c82p-8vqj": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret"
},
"traefik|GHSA-53qr-784g-cj35": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients"
},
"traefik|GHSA-cw35-4q88-3rmp": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another"
},
"traefik|GHSA-fh26-gfpp-7xxx": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)"
},
"traefik|GHSA-hrpp-p4fc-wwf8": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients"
},
"traefik|GHSA-mhjw-hmjv-p99x": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams"
},
"traefik|GHSA-mwrr-6hp4-pxr6": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route"
},
"traefik|GHSA-p8wx-ph99-xgcr": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation"
},
"traefik|GHSA-qm9f-w54v-q2qh": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool"
},
"traefik|GHSA-qvj7-gq9c-hp7q": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth"
},
"traefik|GHSA-rv2h-qh7j-xrjw": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA"
},
"traefik|GHSA-ww7c-q3mv-xx22": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process"
},
"traefik|release:traefik/traefik@v3.7.14": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Advisory GHSA-53qr-784g-cj35"
},
"traefik|release:traefik/traefik@v3.7.15": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Advisory GHSA-p8wx-ph99-xgcr"
},
"traefik|release:traefik/traefik@v3.7.16": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "traefik v3.7.13 (controller infra)",
"summary": "Advisory GHSA-hrpp-p4fc-wwf8"
},
"vikunja/vikunja|GHSA-2f75-93c9-xf32": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Stored rich-text images make viewers' clients probe loopback and LAN addresses"
},
"vikunja/vikunja|GHSA-3x3m-2j93-w46j": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Unbounded avatar size cache exhausts server memory"
},
"vikunja/vikunja|GHSA-49pj-52x6-8gpj": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "No brute-force limit on password re-authentication; TOTP can be disabled with the password alone"
},
"vikunja/vikunja|GHSA-4hv6-xc92-j86g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes"
},
"vikunja/vikunja|GHSA-4qvp-948j-4cgv": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Revoked session's access token keeps working and can mint new credentials"
},
"vikunja/vikunja|GHSA-586f-48mj-3rwr": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Read-only project members see credential-bearing webhook URLs"
},
"vikunja/vikunja|GHSA-5f6v-j6xm-wwj9": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Project-webhook token scope reaches user-level webhooks"
},
"vikunja/vikunja|GHSA-5fc2-w2j4-6r8w": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Bot API tokens keep working after the bot owner's account is disabled or locked"
},
"vikunja/vikunja|GHSA-5q33-h98p-rgh9": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Webhook task payloads bypass read authorization via a no-op kanban bucket move"
},
"vikunja/vikunja|GHSA-66cq-j6rw-pjch": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Webhook payloads leak related tasks from projects the webhook owner can't read"
},
"vikunja/vikunja|GHSA-7f23-p76f-cx74": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Unbounded resize output in task-attachment image preview enables in-process API OOM (unfixed sibling of CVE-2026-91971)"
},
"vikunja/vikunja|GHSA-7gmh-4fw6-8xc5": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Export archives are orphaned on disk and never cleaned up"
},
"vikunja/vikunja|GHSA-9hxw-pxcq-4q8q": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Image decodes have no concurrency bound"
},
"vikunja/vikunja|GHSA-9rfw-7hv4-3vv3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Local file storage blobs and SQLite database are world-readable"
},
"vikunja/vikunja|GHSA-9xh7-5jg8-mf43": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Bucket delete uses the URL view instead of the bucket's real view"
},
"vikunja/vikunja|GHSA-c934-xjq2-mrg3": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "CalDAV VTODO RELATED-TO entries fan out into unbounded dummy tasks"
},
"vikunja/vikunja|GHSA-ff52-3296-2fvr": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Link-share hash logged in the request path"
},
"vikunja/vikunja|GHSA-fjrf-gjmg-9v6g": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Team members cannot be removed after a client writes `external_id`"
},
"vikunja/vikunja|GHSA-fmmf-xq98-g327": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Write-level project members can delete admin-tier link shares through an unloaded permission check"
},
"vikunja/vikunja|GHSA-fprf-r6rv-xg99": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Saved filter creation with an empty filter string recalculates task positions across all tenants"
},
"vikunja/vikunja|GHSA-frf4-3prf-3vch": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Login CSRF via form-encoded login and OIDC callback on /api/v2"
},
"vikunja/vikunja|GHSA-g2xc-jv9q-46wq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "WeKan and vikunja-file imports have no item-count cap, enabling in-process API OOM (unfixed variant of CVE-2026-91969)"
},
"vikunja/vikunja|GHSA-h4q3-mc9r-q7vv": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "TOTP can be enrolled and enabled without the password, letting a stolen session lock the owner out"
},
"vikunja/vikunja|GHSA-h8wj-3gwg-jjjg": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Release toolchain (xgo) pulled by mutable ref"
},
"vikunja/vikunja|GHSA-hjx8-qv73-f7cm": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed"
},
"vikunja/vikunja|GHSA-hm4w-h7v8-ch43": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Nil bucket filter makes project view reads panic"
},
"vikunja/vikunja|GHSA-hq66-9qg8-jwqg": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Account deletion escalates read-only shares to project admin or owner"
},
"vikunja/vikunja|GHSA-hrw2-p27j-8mj8": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Plugin and log directories not re-anchored to the rootpath"
},
"vikunja/vikunja|GHSA-j5v7-qcwp-5g32": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "API token scopes collide between v1 and v2, granting a different verb than intended"
},
"vikunja/vikunja|GHSA-m687-p538-r5hp": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted"
},
"vikunja/vikunja|GHSA-mqq8-869v-48q8": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Vikunja-file ZIP import has no entry-count cap"
},
"vikunja/vikunja|GHSA-p23m-cq25-pc4j": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Stored CSS injection in rich-text (TipTap) renderer via table-cell data-background-color"
},
"vikunja/vikunja|GHSA-p697-wq4x-grpj": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Unbounded bucket count causes per-bucket query fan-out on kanban reads"
},
"vikunja/vikunja|GHSA-pjr3-86v4-5p7w": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regressi"
},
"vikunja/vikunja|GHSA-qf5p-grf5-wcq4": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Password-reset, email-confirm and account-deletion tokens in the URL query reach access logs"
},
"vikunja/vikunja|GHSA-rj93-wmch-2crq": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Changing the API URL sends stored auth tokens to the new origin"
},
"vikunja/vikunja|GHSA-rp33-8f2m-hm6j": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "HTML injection in conversational notification email headers via unescaped doer name and task/project titles (incomplete fix of GHSA-45q4-x4r9-8fqj)"
},
"vikunja/vikunja|GHSA-rp64-xg8g-9mpr": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Dump archive is created with umask permissions"
},
"vikunja/vikunja|GHSA-v3r6-33v3-79c2": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Team self-removal endpoint reveals whether a private team exists"
},
"vikunja/vikunja|GHSA-v579-5fwc-gr28": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "page=0 on v1 list endpoints returns the whole result set, bypassing service.maxitemsperpage"
},
"vikunja/vikunja|GHSA-w64q-7p4m-j8g8": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Kanban task-bucket move lets a user put a task into another project's bucket"
},
"vikunja/vikunja|GHSA-wqjr-22r7-5437": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Trello, Todoist and Microsoft To Do migrations buffer remote downloads and API responses without limits, enabling in-process API OOM"
},
"vikunja/vikunja|GHSA-xgw3-ccqg-f6ww": {
"first": "2026-10-27",
"last_mailed": "2026-10-27",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"silent": "first read after the seed",
"summary": "Migration OAuth callbacks are not bound to the initiating user"
},
"vikunja/vikunja|release:go-vikunja/vikunja@v2.7.0": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"summary": "🔒 Six security fixes"
},
"vikunja/vikunja|release:go-vikunja/vikunja@v2.7.1": {
"first": "2026-10-26",
"last_mailed": "2026-10-26",
"program": "vikunja/vikunja 2.6.0 (vikunja)",
"summary": "🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes"
}
},
"failures": {
"registry:docker.io": {
"mailed": false,
"streak": 1
}
},
"seed_pending": [],
"seeded_at": "2026-10-26",
"version": 1,
"weekly_last": "2026-10-26"
}
Reference in new issue View Git Blame Copy Permalink