896 lines
40 KiB
JSON
896 lines
40 KiB
JSON
{
|
||
"advisories": {
|
||
"cloudflare/cloudflared|feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
|
||
"summary": "8 eMudhra certificates are compromised. Here's what you need to know"
|
||
},
|
||
"cloudflare/cloudflared|vulnnotes:cloudflared@2026.10.4:VULN-176088": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "cloudflare/cloudflared 2026.10.3 (controller infra)",
|
||
"summary": "- 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server"
|
||
},
|
||
"codewithcj/sparkyfitness_server|GHSA-cmmf-53wf-r5gv": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
|
||
"summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
|
||
},
|
||
"codewithcj/sparkyfitness_server|GHSA-p8cf-g8rv-gvrq": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
|
||
"summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
|
||
},
|
||
"codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
|
||
"summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
|
||
},
|
||
"codewithcj/sparkyfitness|GHSA-cmmf-53wf-r5gv": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
|
||
"summary": "Unauthenticated direct access to owner-only pregnancy photos through public static mounts"
|
||
},
|
||
"codewithcj/sparkyfitness|GHSA-p8cf-g8rv-gvrq": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
|
||
"summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
|
||
},
|
||
"codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
|
||
"summary": "Preflight check only verifies BETTER_AUTH_SECRET is present, not that it differs from the documented .env.example default -- an unedited install runs with a kno"
|
||
},
|
||
"docmost/docmost|release:docmost/docmost@v0.97.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "docmost/docmost 0.96.0 (docmost)",
|
||
"summary": "This release includes security fixes for the latest Node"
|
||
},
|
||
"f0rc3/gokapi|GHSA-3c22-5j5m-4jq7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Stored XSS in SVG Hotlinks"
|
||
},
|
||
"f0rc3/gokapi|GHSA-45vh-rpc8-hxpp": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "File Request MaxSize Limit Bypassed in File Request"
|
||
},
|
||
"f0rc3/gokapi|GHSA-4xg4-54hm-9j77": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Stored XSS vulnerability in friendly name for API keys"
|
||
},
|
||
"f0rc3/gokapi|GHSA-95rc-wc32-gm53": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Stored XSS by uploading file with malicious file name"
|
||
},
|
||
"f0rc3/gokapi|GHSA-c36c-7pc2-f2ph": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Data Leak in Upload Status Stream"
|
||
},
|
||
"f0rc3/gokapi|GHSA-hcff-qv74-7hr4": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "CSRF in Login Endpoint"
|
||
},
|
||
"f0rc3/gokapi|GHSA-j6jp-78w8-34x6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Privilege Escalation in File Replace"
|
||
},
|
||
"f0rc3/gokapi|GHSA-m2hx-wjxc-9fp4": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Privilege escalation with auth token"
|
||
},
|
||
"f0rc3/gokapi|GHSA-q658-hfpg-35qc": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "Privilege escalation via incomplete API-key permission revocation on user rank demotion"
|
||
},
|
||
"f0rc3/gokapi|GHSA-qwc6-vc2v-2ggj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "f0rc3/gokapi v1.9.6 (gokapi)",
|
||
"summary": "DoS in API endpoint"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-8j73-j6rc-q8xh": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Third-party notification credentials of other users exposed via request detail endpoints"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-f7xw-jcqr-57hp": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-gx3h-3jg5-q65f": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Missing authentication on pushSubscription endpoints"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-mc6w-69r3-62h8": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Path traversal to RCE via /avatarproxy image cache filename from upstream ETag"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-rc4w-7m3r-c2f7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint"
|
||
},
|
||
"fallenbagel/jellyseerr|GHSA-xc6j-6p6h-p799": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "fallenbagel/jellyseerr 2.7.3 (seerr)",
|
||
"summary": "Unfiltered User Objects (Email, plexId, Permissions) and Issue Contents Leaked via /movie/:id and /tv/:id mediaInfo"
|
||
},
|
||
"flomp/wanderer-db|GHSA-332v-mq7g-5hqf": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
|
||
},
|
||
"flomp/wanderer-db|GHSA-3xp7-7492-j2q6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
|
||
},
|
||
"flomp/wanderer-db|GHSA-8j93-xvwx-jjg3": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
|
||
},
|
||
"flomp/wanderer-db|GHSA-fprh-3pp9-68m9": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
|
||
},
|
||
"flomp/wanderer-db|GHSA-j9m4-8qwf-jvx6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
|
||
},
|
||
"flomp/wanderer-db|GHSA-mr29-2qg5-m4fw": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
|
||
},
|
||
"flomp/wanderer-db|GHSA-vj82-xj83-jp85": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
|
||
},
|
||
"flomp/wanderer-db|GHSA-vprp-gr6m-j375": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
|
||
},
|
||
"flomp/wanderer-db|GHSA-xcwc-jhv2-w4h6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
|
||
},
|
||
"flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )"
|
||
},
|
||
"flomp/wanderer-db|release:open-wanderer/wanderer@v0.21.2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-db v0.20.0 (wanderer)",
|
||
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
|
||
},
|
||
"flomp/wanderer-web|GHSA-332v-mq7g-5hqf": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "Wanderer: create rules for `comments`, `summit_logs` and `trail_like` never bind the `author`/`actor` to the caller, letting any user forge content attributed t"
|
||
},
|
||
"flomp/wanderer-web|GHSA-3xp7-7492-j2q6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources"
|
||
},
|
||
"flomp/wanderer-web|GHSA-8j93-xvwx-jjg3": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "SSRF guard bypass via IPv6 transition addresses in ActivityPub federation (SafeHTTPClient)"
|
||
},
|
||
"flomp/wanderer-web|GHSA-fprh-3pp9-68m9": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Create/Update for comments and summit logs has no ownership check, letting any remote actor overwrite local records and inject unsanitized HTML (inc"
|
||
},
|
||
"flomp/wanderer-web|GHSA-j9m4-8qwf-jvx6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources"
|
||
},
|
||
"flomp/wanderer-web|GHSA-mr29-2qg5-m4fw": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub 入口信任客户端 X-Forwarded-Path，可伪造任意本地 inbox 路由并通过签名校验"
|
||
},
|
||
"flomp/wanderer-web|GHSA-vj82-xj83-jp85": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "wanderer: `waypoints` collection `createRule` omits the trail-ownership check, letting any authenticated user inject (and owner-attributed) waypoints into any o"
|
||
},
|
||
"flomp/wanderer-web|GHSA-vprp-gr6m-j375": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources"
|
||
},
|
||
"flomp/wanderer-web|GHSA-xcwc-jhv2-w4h6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "ActivityPub Delete 处理缺少对象归属校验，任意远程 actor 可删除任意本地 trail/list"
|
||
},
|
||
"flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "Inbound ActivityPub deliveries are now authenticated between the web and db services ( GHSA-mr29-2qg5-m4fw , PR #1205 )"
|
||
},
|
||
"flomp/wanderer-web|release:open-wanderer/wanderer@v0.21.2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "flomp/wanderer-web v0.20.0 (wanderer)",
|
||
"summary": "( GHSA-fprh-3pp9-68m9 , thanks @zer0d4y5 )"
|
||
},
|
||
"freikin/dawarich|release:Freika/dawarich@1.17.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "freikin/dawarich 1.15.3 (dawarich)",
|
||
"summary": "js 20 package, which no longer receives upstream security fixes"
|
||
},
|
||
"ghcr.io/advplyr/audiobookshelf|release:advplyr/audiobookshelf@v2.37.2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/advplyr/audiobookshelf 2.37.1 (audiobookshelf)",
|
||
"summary": "1 (October 2026 security release)"
|
||
},
|
||
"ghcr.io/alam00000/bentopdf|GHSA-5xjf-rr5x-pcfj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
|
||
"summary": "SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass"
|
||
},
|
||
"ghcr.io/alam00000/bentopdf|GHSA-cx8x-7rrr-r9x8": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
|
||
"summary": "Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests"
|
||
},
|
||
"ghcr.io/alam00000/bentopdf|GHSA-wh78-rcw2-hhg9": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
|
||
"summary": "SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker"
|
||
},
|
||
"ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.10": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
|
||
"summary": "Warning This release addresses security vulnerabilities ( GHSA-v77x-cvmx-ggp4 , GHSA-qch9-77q9-j7p6 ) affecting all versions up to and including v2"
|
||
},
|
||
"ghcr.io/alam00000/bentopdf|release:alam00000/bentopdf@v2.8.7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/alam00000/bentopdf v2.8.6 (bentopdf)",
|
||
"summary": "Warning This release addresses security vulnerabilities ( GHSA-wh78-rcw2-hhg9 , GHSA-5xjf-rr5x-pcfj , GHSA-cx8x-7rrr-r9x8 ) affecting all versions up to and "
|
||
},
|
||
"ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.68.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
|
||
"summary": "Update dependency nodemailer to v10 [SECURITY] by @renovate [bot] in #798"
|
||
},
|
||
"ghcr.io/cmintey/wishlist|release:cmintey/wishlist@v0.69.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/cmintey/wishlist v0.67.1 (wishlist)",
|
||
"summary": "org/en/blog/vulnerability/october-2026-security-releases"
|
||
},
|
||
"ghcr.io/home-assistant/home-assistant|GHSA-jff5-5j3g-vhqc": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/home-assistant/home-assistant 2026.9.4 (home-assistant)",
|
||
"summary": "Actions expression injection in `helpers/version/action.yml`"
|
||
},
|
||
"ghcr.io/immich-app/immich-machine-learning|GHSA-8244-8vpr-vp9c": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
|
||
"summary": "One-click account takeover via XSS in login page continue redirect"
|
||
},
|
||
"ghcr.io/immich-app/immich-machine-learning|release:immich-app/immich@v3.3.5": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/immich-app/immich-machine-learning v3.2.4 (immich)",
|
||
"summary": "com/ ) as well as some nodejs security patches"
|
||
},
|
||
"ghcr.io/immich-app/immich-server|GHSA-8244-8vpr-vp9c": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
|
||
"summary": "One-click account takeover via XSS in login page continue redirect"
|
||
},
|
||
"ghcr.io/immich-app/immich-server|release:immich-app/immich@v3.3.5": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/immich-app/immich-server v3.2.4 (immich)",
|
||
"summary": "com/ ) as well as some nodejs security patches"
|
||
},
|
||
"ghcr.io/karakeep-app/karakeep|GHSA-pp34-2c9r-mchw": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
|
||
"summary": "karakeep-chrome ships Chromium 151.0.7922.47, which is affected by two CVEs in CISA KEV"
|
||
},
|
||
"ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
|
||
"summary": "1 for its October security release ( #3196 )"
|
||
},
|
||
"ghcr.io/karakeep-app/karakeep|release:karakeep-app/karakeep@v0.34.1": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/karakeep-app/karakeep 0.33.2 (karakeep)",
|
||
"summary": "This is a security release on top of 0"
|
||
},
|
||
"ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
|
||
"summary": "Security Issues Patched"
|
||
},
|
||
"ghcr.io/sysadminsmedia/homebox|release:sysadminsmedia/homebox@v0.27.1": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/sysadminsmedia/homebox 0.26.2 (homebox)",
|
||
"summary": "Warning This release is a security release to patch a NodeJS upstream vulnerability"
|
||
},
|
||
"ghcr.io/tandoorrecipes/recipes|release:TandoorRecipes/recipes@2.7.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "ghcr.io/tandoorrecipes/recipes 2.6.15 (tandoor)",
|
||
"summary": "fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3"
|
||
},
|
||
"grafana/grafana|release:grafana/grafana@v13.2.4": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "grafana/grafana 13.2.3 (grafana)",
|
||
"summary": "Security: Fix CVE-2026-15577"
|
||
},
|
||
"gtstef/filebrowser|GHSA-26fh-r34c-qxh6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Moving or renaming a folder retargets public shares to the whole folder"
|
||
},
|
||
"gtstef/filebrowser|GHSA-3846-gh75-gp3m": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-3j46-5w28-f8p2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write"
|
||
},
|
||
"gtstef/filebrowser|GHSA-4fhx-8pf6-5gmr": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Duplicate finder can show another user’s restricted file names from a shared cache"
|
||
},
|
||
"gtstef/filebrowser|GHSA-4v62-884x-2466": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback"
|
||
},
|
||
"gtstef/filebrowser|GHSA-4vrc-935w-xxq2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonical"
|
||
},
|
||
"gtstef/filebrowser|GHSA-4wmj-rq3c-m65v": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`"
|
||
},
|
||
"gtstef/filebrowser|GHSA-55mw-cwg7-m8f5": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "`GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting"
|
||
},
|
||
"gtstef/filebrowser|GHSA-6gr6-5qpq-888p": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum"
|
||
},
|
||
"gtstef/filebrowser|GHSA-8655-2ph3-q7q7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled"
|
||
},
|
||
"gtstef/filebrowser|GHSA-8m35-wcjh-95q7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Logout Bypass via Alternate JWT Spelling"
|
||
},
|
||
"gtstef/filebrowser|GHSA-9fcr-gm58-p839": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors"
|
||
},
|
||
"gtstef/filebrowser|GHSA-9wm6-jcjh-3m8c": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Stored XSS via Unsanitized DOCX Hyperlink in DocViewer"
|
||
},
|
||
"gtstef/filebrowser|GHSA-c7pj-xjp9-x4xp": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Read-only users can overwrite files through PUT /api/resources"
|
||
},
|
||
"gtstef/filebrowser|GHSA-c84q-q5g6-r47f": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-c9cr-w724-gqj3": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin"
|
||
},
|
||
"gtstef/filebrowser|GHSA-cw65-p35p-633w": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-g2q5-r6ch-v25f": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-gfgm-886h-6r47": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Custom API token with no global caps inherits owner admin access"
|
||
},
|
||
"gtstef/filebrowser|GHSA-mgqf-5mf5-prfj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Symlink following escapes user scope allowing arbitrary file read outside the served directory"
|
||
},
|
||
"gtstef/filebrowser|GHSA-p7x3-p5jj-9xfh": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions"
|
||
},
|
||
"gtstef/filebrowser|GHSA-p93p-v944-4p44": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Unarchive writes into folders denied by access rules and overwrites files without modify permission"
|
||
},
|
||
"gtstef/filebrowser|GHSA-p9wm-f5jj-75pj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS"
|
||
},
|
||
"gtstef/filebrowser|GHSA-qqf3-2wvq-q4w9": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Archive download follows symlinks out of source scope (arbitrary file read)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-qv53-4557-m65h": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key"
|
||
},
|
||
"gtstef/filebrowser|GHSA-qx86-4v5r-26g5": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-r744-4vm3-2px3": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and pas"
|
||
},
|
||
"gtstef/filebrowser|GHSA-rmjp-pfrq-cc3v": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN"
|
||
},
|
||
"gtstef/filebrowser|GHSA-rqqq-wv83-rp74": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope"
|
||
},
|
||
"gtstef/filebrowser|GHSA-vvm6-jwrf-hgmg": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": " Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape"
|
||
},
|
||
"gtstef/filebrowser|GHSA-wfjp-qhvc-69wp": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Share path re-point allows scope escape (arbitrary read/write across the source root)"
|
||
},
|
||
"gtstef/filebrowser|GHSA-wjp8-g49g-xrhx": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it"
|
||
},
|
||
"gtstef/filebrowser|GHSA-wxj5-g3qp-g732": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/"
|
||
},
|
||
"gtstef/filebrowser|GHSA-x79q-5hqm-x839": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "Share authorization gaps let read-only users delete files"
|
||
},
|
||
"gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.7-stable": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac"
|
||
},
|
||
"gtstef/filebrowser|release:gtsteffaniak/filebrowser@v1.5.8-stable": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "gtstef/filebrowser 1.5.6-stable (controller infra)",
|
||
"summary": "[High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second fac"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-4vx8-xhc9-qg6x": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": " Broken access control in session remote-control API"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-6828-c7cx-hvqm": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": " Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-9x85-gx46-6522": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": "Potential IDOR in playlist management"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-c39p-cgf8-866g": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": "Potential path transversal exposure in PluginsController.cs"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-cf3c-8m59-2vhx": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": "Memory exhaustion and SSRF via external references in user-supplied SVG images"
|
||
},
|
||
"jellyfin/jellyfin|GHSA-hw73-62vp-9gxf": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "jellyfin/jellyfin 10.11.11 (jellyfin)",
|
||
"summary": "Potential path transversal exposure in HlsSegmentController.cs"
|
||
},
|
||
"louislam/uptime-kuma|GHSA-qjxc-h5jf-c7rj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||
"summary": "GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extract sensitive information via authentificated accou"
|
||
},
|
||
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||
"summary": "⬆️ Security Fixes"
|
||
},
|
||
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.7": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||
"summary": "⬆️ Security Fixes"
|
||
},
|
||
"louislam/uptime-kuma|release:louislam/uptime-kuma@2.5.8": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "louislam/uptime-kuma 2.5.5 (uptime-kuma)",
|
||
"summary": "⬆️ Security Fixes"
|
||
},
|
||
"lscr.io/linuxserver/bookstack|release:BookStackApp/BookStack@v26.09.2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lscr.io/linuxserver/bookstack 26.09.1 (bookstack)",
|
||
"summary": "Security Release"
|
||
},
|
||
"lscr.io/linuxserver/code-server|release:coder/code-server@v4.141.1": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lscr.io/linuxserver/code-server 4.129.0 (code-server)",
|
||
"summary": "Brotli decoder ( CVE-2026-111497 )"
|
||
},
|
||
"lukevella/rallly|GHSA-gmq4-f8j5-8w8q": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lukevella/rallly 4.15.3 (rallly)",
|
||
"summary": "Remote code execution in poll preview images via vulnerable Next.js next/og"
|
||
},
|
||
"lukevella/rallly|release:lukevella/rallly@v4.15.4": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lukevella/rallly 4.15.3 (rallly)",
|
||
"summary": "🔒 Critical security fix: remote code execution in poll preview images"
|
||
},
|
||
"lukevella/rallly|release:lukevella/rallly@v4.15.5": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lukevella/rallly 4.15.3 (rallly)",
|
||
"summary": "🔒 Security fix: denial of service through Server Actions"
|
||
},
|
||
"lukevella/rallly|release:lukevella/rallly@v4.16.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lukevella/rallly 4.15.3 (rallly)",
|
||
"summary": "The Control Panel tells you when an update is available and whether it fixes a security issue"
|
||
},
|
||
"lukevella/rallly|release:lukevella/rallly@v4.16.2": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "lukevella/rallly 4.15.3 (rallly)",
|
||
"summary": "js security update"
|
||
},
|
||
"outlinewiki/outline|release:outline/outline@v1.12.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "outlinewiki/outline 1.10.1 (outline)",
|
||
"summary": "1 which fixes multiple recently disclosed vulnerabilities"
|
||
},
|
||
"privatebin/pdo|release:PrivateBin/PrivateBin@2.1.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "privatebin/pdo 2.0.6 (privatebin)",
|
||
"summary": "More details on this issue can be found in the security advisory:"
|
||
},
|
||
"rommapp/romm|release:rommapp/romm@5.4.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "rommapp/romm 5.3.1 (romm)",
|
||
"summary": "0 [security] by @renovate [bot] in #4966"
|
||
},
|
||
"rommapp/romm|release:rommapp/romm@5.4.1": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "rommapp/romm 5.3.1 (romm)",
|
||
"summary": "While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible"
|
||
},
|
||
"traefik|GHSA-28hp-c82p-8vqj": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret"
|
||
},
|
||
"traefik|GHSA-53qr-784g-cj35": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients"
|
||
},
|
||
"traefik|GHSA-cw35-4q88-3rmp": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another"
|
||
},
|
||
"traefik|GHSA-fh26-gfpp-7xxx": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)"
|
||
},
|
||
"traefik|GHSA-hrpp-p4fc-wwf8": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients"
|
||
},
|
||
"traefik|GHSA-mhjw-hmjv-p99x": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams"
|
||
},
|
||
"traefik|GHSA-mwrr-6hp4-pxr6": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route"
|
||
},
|
||
"traefik|GHSA-p8wx-ph99-xgcr": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation"
|
||
},
|
||
"traefik|GHSA-qm9f-w54v-q2qh": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool"
|
||
},
|
||
"traefik|GHSA-qvj7-gq9c-hp7q": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth"
|
||
},
|
||
"traefik|GHSA-rv2h-qh7j-xrjw": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA"
|
||
},
|
||
"traefik|GHSA-ww7c-q3mv-xx22": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process"
|
||
},
|
||
"traefik|release:traefik/traefik@v3.7.14": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Advisory GHSA-53qr-784g-cj35"
|
||
},
|
||
"traefik|release:traefik/traefik@v3.7.15": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Advisory GHSA-p8wx-ph99-xgcr"
|
||
},
|
||
"traefik|release:traefik/traefik@v3.7.16": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "traefik v3.7.13 (controller infra)",
|
||
"summary": "Advisory GHSA-hrpp-p4fc-wwf8"
|
||
},
|
||
"vikunja/vikunja|release:go-vikunja/vikunja@v2.7.0": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "vikunja/vikunja 2.6.0 (vikunja)",
|
||
"summary": "🔒 Six security fixes"
|
||
},
|
||
"vikunja/vikunja|release:go-vikunja/vikunja@v2.7.1": {
|
||
"first": "2026-10-26",
|
||
"last_mailed": "2026-10-26",
|
||
"program": "vikunja/vikunja 2.6.0 (vikunja)",
|
||
"summary": "🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes"
|
||
}
|
||
},
|
||
"failures": {},
|
||
"seed_pending": [
|
||
"actualbudget/actual-server",
|
||
"calcom/cal.com",
|
||
"deluan/navidrome",
|
||
"freikin/dawarich",
|
||
"getmeili/meilisearch",
|
||
"ghcr.io/alexta69/metube",
|
||
"ghcr.io/diced/zipline",
|
||
"ghcr.io/gethomepage/homepage",
|
||
"ghcr.io/lukegus/termix",
|
||
"ghcr.io/mealie-recipes/mealie",
|
||
"ghcr.io/paperless-ngx/paperless-ngx",
|
||
"ghcr.io/papra-hq/papra",
|
||
"ghcr.io/sysadminsmedia/homebox",
|
||
"ghcr.io/tandoorrecipes/recipes",
|
||
"ghost",
|
||
"gitea/gitea",
|
||
"glanceapp/glance",
|
||
"gotson/komga",
|
||
"grafana/grafana",
|
||
"lscr.io/linuxserver/bookstack",
|
||
"lscr.io/linuxserver/code-server",
|
||
"lscr.io/linuxserver/prowlarr",
|
||
"lscr.io/linuxserver/radarr",
|
||
"lscr.io/linuxserver/sabnzbd",
|
||
"lscr.io/linuxserver/transmission",
|
||
"n8nio/n8n",
|
||
"nginx",
|
||
"outlinewiki/outline",
|
||
"privatebin/pdo",
|
||
"rommapp/romm",
|
||
"vaultwarden/server",
|
||
"vikunja/vikunja",
|
||
"wger/server"
|
||
],
|
||
"seeded_at": "2026-10-26",
|
||
"version": 1,
|
||
"weekly_last": "2026-10-26"
|
||
}
|