October 2026 - notifications

[xwiki/xwiki-dev-llm] a5a997: [Misc] Clarify how to score CVSS impacts for gaine...
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: a5a9971a30efec90406129f8b2de8e78a5f05a60 https://github.com/xwiki/xwiki-dev-llm/commit/a5a9971a30efec90406129f8b2de8… Author: Simon Urli <simon.urli(a)xwiki.com> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Clarify how to score CVSS impacts for gained rights and preconditions * A right the attack yields never caps the impacts: only a right it needs does. * Score impacts from what the attacker can achieve, not from what a PoC printed. * Check the usual wiki access setups before calling an Attack Requirement rare. * Drop a sentence restating that per-metric values are not cached. Co-Authored-By: Claude Opus 5.5 <noreply(a)anthropic.com> Commit: b5e78b6137a74b6aa34917972da610cd8b27733e https://github.com/xwiki/xwiki-dev-llm/commit/b5e78b6137a74b6aa34917972da61… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Tighten the CVSS impact and Attack Requirements traps * Keep the right cap bullet to the cap; state the 'score by reach' rule once, in the achievable-impact bullet. * Phrase the access-setup check in CVSS terms (setting Attack Requirements to Present) and give it its own bullet, out of the 'no XWiki best practice' one. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> Commit: dc31a70418839b13d567241d41267e8435129476 https://github.com/xwiki/xwiki-dev-llm/commit/dc31a70418839b13d567241d41267… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Add the Attack Complexity trap to the CVSS scoring traps * Attack Complexity is a protection to defeat, never the privilege the attacker holds, which Privileges Required already encodes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> Commit: 43ecf7f95f116bc3612d1205900c3010cc6e3f79 https://github.com/xwiki/xwiki-dev-llm/commit/43ecf7f95f116bc3612d1205900c3… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #236 from xwiki/cvss-impact-review-fixes [Misc] Tighten the CVSS impact and Attack Requirements traps Commit: 533a556979d0e66818580dd43a28b9f78e62d44a https://github.com/xwiki/xwiki-dev-llm/commit/533a556979d0e66818580dd43a28b… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #235 from xwiki/cvss-impact-from-achievable [Misc] Clarify how to score CVSS impacts for gained rights and preconditions Compare: https://github.com/xwiki/xwiki-dev-llm/compare/b1cfcbc91c35...533a556979d0 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/cvss-impact-review-fixes Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] b5e78b: [Misc] Tighten the CVSS impact and Attack Requirem...
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/cvss-impact-from-achievable Home: https://github.com/xwiki/xwiki-dev-llm Commit: b5e78b6137a74b6aa34917972da610cd8b27733e https://github.com/xwiki/xwiki-dev-llm/commit/b5e78b6137a74b6aa34917972da61… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Tighten the CVSS impact and Attack Requirements traps * Keep the right cap bullet to the cap; state the 'score by reach' rule once, in the achievable-impact bullet. * Phrase the access-setup check in CVSS terms (setting Attack Requirements to Present) and give it its own bullet, out of the 'no XWiki best practice' one. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> Commit: dc31a70418839b13d567241d41267e8435129476 https://github.com/xwiki/xwiki-dev-llm/commit/dc31a70418839b13d567241d41267… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Add the Attack Complexity trap to the CVSS scoring traps * Attack Complexity is a protection to defeat, never the privilege the attacker holds, which Privileges Required already encodes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> Commit: 43ecf7f95f116bc3612d1205900c3010cc6e3f79 https://github.com/xwiki/xwiki-dev-llm/commit/43ecf7f95f116bc3612d1205900c3… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- Merge pull request #236 from xwiki/cvss-impact-review-fixes [Misc] Tighten the CVSS impact and Attack Requirements traps Compare: https://github.com/xwiki/xwiki-dev-llm/compare/a5a9971a30ef...43ecf7f95f11 To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] dc31a7: [Misc] Add the Attack Complexity trap to the CVSS ...
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/cvss-impact-review-fixes Home: https://github.com/xwiki/xwiki-dev-llm Commit: dc31a70418839b13d567241d41267e8435129476 https://github.com/xwiki/xwiki-dev-llm/commit/dc31a70418839b13d567241d41267… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Add the Attack Complexity trap to the CVSS scoring traps * Attack Complexity is a protection to defeat, never the privilege the attacker holds, which Privileges Required already encodes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] b5e78b: [Misc] Tighten the CVSS impact and Attack Requirem...
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/cvss-impact-review-fixes Home: https://github.com/xwiki/xwiki-dev-llm Commit: b5e78b6137a74b6aa34917972da610cd8b27733e https://github.com/xwiki/xwiki-dev-llm/commit/b5e78b6137a74b6aa34917972da61… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/processes/security-policy.md Log Message: ----------- [Misc] Tighten the CVSS impact and Attack Requirements traps * Keep the right cap bullet to the cap; state the 'score by reach' rule once, in the achievable-impact bullet. * Phrase the access-setup check in CVSS terms (setting Attack Requirements to Present) and give it its own bullet, out of the 'no XWiki best practice' one. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/tags/v1.18.5 Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] b1cfcb: [Misc] Release 1.18.5
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: b1cfcbc91c35385d19f88afe08d0e2dc60a25853 https://github.com/xwiki/xwiki-dev-llm/commit/b1cfcbc91c35385d19f88afe08d0e… Author: github-actions[bot] <41898282+github-actions[bot](a)users.noreply.github.com> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M .claude-plugin/marketplace.json M kimi.plugin.json M opencode.jsonc M xwiki/.claude-plugin/plugin.json Log Message: ----------- [Misc] Release 1.18.5 * content edits only (no capability added or removed) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm]
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/advisory-link-documentation-field Home: https://github.com/xwiki/xwiki-dev-llm To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[xwiki/xwiki-dev-llm] d7ee5d: [Misc] Link a security issue's advisory as a JIRA ...
by XWiki Notifications 12 Oct '26

12 Oct '26

Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-dev-llm Commit: d7ee5db633a046973acf9e760572157099a242fc https://github.com/xwiki/xwiki-dev-llm/commit/d7ee5db633a046973acf9e7605721… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/servers/jira.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- [Misc] Link a security issue's advisory as a JIRA web link * okf/servers/jira.md says the GHSA goes in a "Security Advisory" web link, not in Documentation, a comment or a label * xwiki-security-advisory Step 6 points to it Co-Authored-By: Claude Opus 5.5 (1M context) <noreply(a)anthropic.com> Commit: e397b9b8497c26cfdb431e06e5e67e1b23276934 https://github.com/xwiki/xwiki-dev-llm/commit/e397b9b8497c26cfdb431e06e5e67… Author: Vincent Massol <vincent(a)massol.net> Date: 2026-10-12 (Mon, 12 Oct 2026) Changed paths: M xwiki/okf/servers/jira.md M xwiki/skills/xwiki-security-advisory/SKILL.md Log Message: ----------- Merge pull request #205 from xwiki/advisory-link-documentation-field [Misc] Link a security issue's advisory as a JIRA web link Compare: https://github.com/xwiki/xwiki-dev-llm/compare/5b3e46a3a070...e397b9b8497c To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-dev-llm/settings/notifications

1 0

[[email protected]][Issue] Updates for SPAPP-36: Compute embargo flag is switched after being manually updated
by XWiki Notifications 12 Oct '26

12 Oct '26

1 0