Sync Collecting Fix Commits: Sun Aug 30 08:48:18 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,36 @@
 {
   "vcs_url": "https://github.com/github/advisory-database",
   "vulnerabilities": {
+    "GHSA-6CV3-J4MC-JF2R": {
+      "86a891354e54e56948849b7f16a55d166fb8d24c": "Publish Advisories\n\nGHSA-6cv3-j4mc-jf2r\nGHSA-6hcx-8gm4-gx5h\nGHSA-fq2p-334f-fcrf\nGHSA-h35r-6hg6-mcg3"
+    },
+    "GHSA-6HCX-8GM4-GX5H": {
+      "86a891354e54e56948849b7f16a55d166fb8d24c": "Publish Advisories\n\nGHSA-6cv3-j4mc-jf2r\nGHSA-6hcx-8gm4-gx5h\nGHSA-fq2p-334f-fcrf\nGHSA-h35r-6hg6-mcg3"
+    },
+    "GHSA-FQ2P-334F-FCRF": {
+      "86a891354e54e56948849b7f16a55d166fb8d24c": "Publish Advisories\n\nGHSA-6cv3-j4mc-jf2r\nGHSA-6hcx-8gm4-gx5h\nGHSA-fq2p-334f-fcrf\nGHSA-h35r-6hg6-mcg3"
+    },
+    "GHSA-H35R-6HG6-MCG3": {
+      "86a891354e54e56948849b7f16a55d166fb8d24c": "Publish Advisories\n\nGHSA-6cv3-j4mc-jf2r\nGHSA-6hcx-8gm4-gx5h\nGHSA-fq2p-334f-fcrf\nGHSA-h35r-6hg6-mcg3"
+    },
+    "GHSA-699J-WCW4-P222": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
+    "GHSA-6R97-7V62-FG94": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
+    "GHSA-F3QF-7C7X-V322": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
+    "GHSA-FCMG-GFW5-MXQ8": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
+    "GHSA-H63F-8GW3-5HC5": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
+    "GHSA-RJHQ-Q858-QC66": {
+      "8b4d0f815ce277b9ea905743a58f75725d01876e": "Publish Advisories\n\nGHSA-699j-wcw4-p222\nGHSA-6r97-7v62-fg94\nGHSA-f3qf-7c7x-v322\nGHSA-fcmg-gfw5-mxq8\nGHSA-h63f-8gw3-5hc5\nGHSA-rjhq-q858-qc66"
+    },
     "GHSA-8FC6-VV8J-HX7J": {
       "6b71cf85501995f7aefae7d2f41f6f43bc1b3c3d": "Publish Advisories\n\nGHSA-8fc6-vv8j-hx7j\nGHSA-gr3c-pxfm-8894"
     },

data/fix-commits/lxd-0a821e82.json

@@ -2,9 +2,11 @@
   "vcs_url": "https://github.com/lxc/lxd",
   "vulnerabilities": {
     "CVE-2026-81500": {
+      "8723e980417255462f5123b2aff30973673b2076": "client/images: Prevent path traversal in downloaded image name\n\nThe local filename for an exported image came from server-controlled\ndata (Content-Disposition for unified images, the simplestreams index\npath) and was joined with the target directory. Basename it.\n\nThis addresses CVE-2026-81500\n\nSigned-off-by: St\u00e9phane Graber <stgraber@stgraber.org>",
       "9e188e31e43c21fa8f2a4cac265aa246d4c947f2": "client/images: Prevent path traversal in downloaded image name\n\nThe local filename for an exported image came from server-controlled\ndata (Content-Disposition for unified images, the simplestreams index\npath) and was joined with the target directory. Basename it.\n\nThis addresses CVE-2026-81500\n\nSigned-off-by: St\u00e9phane Graber <stgraber@stgraber.org>"
     },
     "CVE-2026-81501": {
+      "2521bf480af23765ea25754fd9a0a2ca146945c6": "incusd/images: Check access before reusing cross-project image\n\nimageDownload reused an image from another project without checking the\ncaller could view it, letting a client that knew a private fingerprint\nimport it. Only reuse it directly when public or viewable, otherwise\ndownload it (proving access) and dedupe against the on-disk copy.\n\nThis addresses CVE-2026-81501\n\nSigned-off-by: St\u00e9phane Graber <stgraber@stgraber.org>",
       "83682ab16af5777b2a5650bb7c9878d57d0187f9": "incusd/images: Check access before reusing cross-project image\n\nimageDownload reused an image from another project without checking the\ncaller could view it, letting a client that knew a private fingerprint\nimport it. Only reuse it directly when public or viewable, otherwise\ndownload it (proving access) and dedupe against the on-disk copy.\n\nThis addresses CVE-2026-81501\n\nSigned-off-by: St\u00e9phane Graber <stgraber@stgraber.org>"
     },
     "GHSA-6V6X-387M-RJ4W": {