Ashesh Vashi ba9ff51aaa docs: assign CVE IDs to v9.15 release-notes placeholders ...

Replaces the "(CVE pending)" markers on the seven placeholder issues
with their assigned identifiers:

  #9830 -> CVE-2026-7813   (cross-user data access / shared-server escalation)
  #9865 -> CVE-2026-7814   (stored XSS via crafted PostgreSQL object names)
  #9898 -> CVE-2026-7815   (SQL injection in Maintenance tool option values)
  #9899 -> CVE-2026-7816   (OS command injection in Import/Export query export)
  #9900 -> CVE-2026-7817   (LFI/SSRF in LLM API configuration endpoints)
  #9901 -> CVE-2026-7818   (unsafe deserialization in session manager)
  #9902 -> CVE-2026-7819   (symlink path traversal in file manager)
  #9904 -> CVE-2026-7820   (account-lockout bypass via Flask-Security /login)

#9835 is a follow-up to #9830 and shares CVE-2026-7813, so its
parenthetical is dropped rather than replaced with a separate ID.

To be revealed publicly when this branch is pushed for the 9.15 release.

2026-05-05 16:14:02 +05:30

..

en_US

docs: assign CVE IDs to v9.15 release-notes placeholders

2026-05-05 16:14:02 +05:30

proposals

fix: SESSION_DIGEST_METHOD default to sha256, follow-up review polish

2026-05-01 16:38:49 +05:30