From 1fb95ca40ce21872a471d861b0cd000a69406449 Mon Sep 17 00:00:00 2001
From: Michael M Slusarz <slusarz@users.noreply.github.com>
Date: Wed, 16 Sep 2026 11:53:18 -0600
Subject: [PATCH 1/2] main: Parse CVE information from OX CSAF website

CVEs that pre-date CSAF program will continue to be stored
inside this project, albeit now in a single .json file.
---
 main/package.json                            |   1 +
 main/scripts/fetch-csaf.js                   | 244 +++++++++++++++++++
 main/scripts/parse-markdown.js               |  36 +--
 main/src/lib/data/legacy-security.json       | 149 +++++++++++
 main/src/lib/data/security/CVE-2019-10691.md |   7 -
 main/src/lib/data/security/CVE-2019-11494.md |   7 -
 main/src/lib/data/security/CVE-2019-11499.md |   6 -
 main/src/lib/data/security/CVE-2019-11500.md |   7 -
 main/src/lib/data/security/CVE-2019-19722.md |   6 -
 main/src/lib/data/security/CVE-2019-3814.md  |   7 -
 main/src/lib/data/security/CVE-2019-7524.md  |   7 -
 main/src/lib/data/security/CVE-2020-10957.md |   7 -
 main/src/lib/data/security/CVE-2020-10958.md |   7 -
 main/src/lib/data/security/CVE-2020-10967.md |   7 -
 main/src/lib/data/security/CVE-2020-12100.md |   6 -
 main/src/lib/data/security/CVE-2020-12673.md |   7 -
 main/src/lib/data/security/CVE-2020-12674.md |   7 -
 main/src/lib/data/security/CVE-2020-24386.md |   7 -
 main/src/lib/data/security/CVE-2020-25275.md |   7 -
 main/src/lib/data/security/CVE-2020-28200.md |   7 -
 main/src/lib/data/security/CVE-2020-7046.md  |   7 -
 main/src/lib/data/security/CVE-2020-7957.md  |   7 -
 main/src/lib/data/security/CVE-2021-29157.md |   7 -
 main/src/lib/data/security/CVE-2021-33515.md |   7 -
 main/src/lib/data/security/CVE-2022-30550.md |   7 -
 main/src/lib/data/security/CVE-2024-23184.md |   7 -
 main/src/lib/data/security/CVE-2024-23185.md |   7 -
 main/src/lib/data/security/CVE-2025-30189.md |   6 -
 main/src/lib/data/security/CVE-2025-59028.md |   6 -
 main/src/lib/data/security/CVE-2025-59031.md |   6 -
 main/src/lib/data/security/CVE-2025-59032.md |   6 -
 main/src/lib/data/security/CVE-2026-0394.md  |   6 -
 main/src/lib/data/security/CVE-2026-24031.md |   6 -
 main/src/lib/data/security/CVE-2026-27855.md |   6 -
 main/src/lib/data/security/CVE-2026-27856.md |   6 -
 main/src/lib/data/security/CVE-2026-27857.md |   6 -
 main/src/lib/data/security/CVE-2026-27858.md |   6 -
 main/src/lib/data/security/CVE-2026-27859.md |   6 -
 main/src/lib/data/security/CVE-2026-27860.md |   6 -
 main/vite.config.ts                          |   3 +-
 40 files changed, 399 insertions(+), 264 deletions(-)
 create mode 100644 main/scripts/fetch-csaf.js
 create mode 100644 main/src/lib/data/legacy-security.json
 delete mode 100644 main/src/lib/data/security/CVE-2019-10691.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-11494.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-11499.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-11500.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-19722.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-3814.md
 delete mode 100644 main/src/lib/data/security/CVE-2019-7524.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-10957.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-10958.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-10967.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-12100.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-12673.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-12674.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-24386.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-25275.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-28200.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-7046.md
 delete mode 100644 main/src/lib/data/security/CVE-2020-7957.md
 delete mode 100644 main/src/lib/data/security/CVE-2021-29157.md
 delete mode 100644 main/src/lib/data/security/CVE-2021-33515.md
 delete mode 100644 main/src/lib/data/security/CVE-2022-30550.md
 delete mode 100644 main/src/lib/data/security/CVE-2024-23184.md
 delete mode 100644 main/src/lib/data/security/CVE-2024-23185.md
 delete mode 100644 main/src/lib/data/security/CVE-2025-30189.md
 delete mode 100644 main/src/lib/data/security/CVE-2025-59028.md
 delete mode 100644 main/src/lib/data/security/CVE-2025-59031.md
 delete mode 100644 main/src/lib/data/security/CVE-2025-59032.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-0394.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-24031.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27855.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27856.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27857.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27858.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27859.md
 delete mode 100644 main/src/lib/data/security/CVE-2026-27860.md

diff --git a/main/package.json b/main/package.json
index 3e85047..ce9d573 100644
--- a/main/package.json
+++ b/main/package.json
@@ -15,6 +15,7 @@
   "author": "Dovecot Authors",
   "scripts": {
     "dev": "vite dev",
+    "dev-production": "vite dev --mode dev-production",
     "build": "vite build",
     "preview": "vite preview",
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
diff --git a/main/scripts/fetch-csaf.js b/main/scripts/fetch-csaf.js
new file mode 100644
index 0000000..96c0c56
--- /dev/null
+++ b/main/scripts/fetch-csaf.js
@@ -0,0 +1,244 @@
+// @ts-nocheck
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const CSAF_ROOT = 'https://documentation.open-xchange.com/dovecot/security/advisories/csaf/';
+
+const projectRoot = path.resolve(__dirname, '..');
+const legacySecurityPath = path.join(projectRoot, 'src/lib/data/legacy-security.json');
+const outputSecurity = path.join(projectRoot, 'src/lib/data/security.json');
+
+const DUMMY_ENTRY = [
+	{
+		id: 'CVE-0000-00000',
+		severity: 'moderate',
+		date: '01 Jan 2024',
+		description:
+			'Dev mode placeholder — CSAF data not fetched. Run npm run dev-production to fetch real data.',
+		link: ''
+	}
+];
+
+// --- Date helpers ---
+
+function normalizeDate(isoDate) {
+	const d = new Date(isoDate);
+	if (isNaN(d)) return isoDate;
+	const months = [
+		'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',
+		'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'
+	];
+	return `${String(d.getUTCDate()).padStart(2, '0')} ${months[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+
+// --- Severity helpers ---
+
+function normalizeSeverity(baseSeverity) {
+	return { HIGH: 'high', CRITICAL: 'high', LOW: 'low' }[(baseSeverity || '').toUpperCase()] || 'moderate';
+}
+
+// --- CE product filtering helpers ---
+
+/**
+ * Collects the product IDs that belong to the "OX Dovecot CE" branch.
+ * Returns null when the product_tree has no such branch (pre-split era,
+ * where "OX Dovecot Pro core" covered both Pro and CE — show everything).
+ */
+function collectCeProductIds(productTree) {
+	for (const vendorBranch of productTree?.branches || []) {
+		for (const productBranch of vendorBranch.branches || []) {
+			if (productBranch.name !== 'OX Dovecot CE') continue;
+			const ceIds = new Set();
+			for (const versionBranch of productBranch.branches || []) {
+				if (versionBranch.product?.product_id) {
+					ceIds.add(versionBranch.product.product_id);
+				}
+			}
+			return ceIds;
+		}
+	}
+	return null;
+}
+
+// Post-split: show only if a CE product ID appears in known/last_affected.
+function affectsCe(vulnerability, ceIds) {
+	if (!ceIds) return true; // pre-split or no product_tree: Pro core == CE
+	const status = vulnerability.product_status || {};
+	const candidates = [...(status.known_affected || []), ...(status.last_affected || [])];
+	return candidates.some((id) => ceIds.has(id));
+}
+
+// Post-split: prefer the score entry whose products list includes a CE product ID.
+function pickSeverity(vulnerability, ceIds) {
+	const scores = vulnerability.scores || [];
+	if (!scores.length) return 'moderate';
+
+	if (ceIds) {
+		const ceScore = scores.find((s) => (s.products || []).some((p) => ceIds.has(p)));
+		if (ceScore) return normalizeSeverity(ceScore.cvss_v3?.baseSeverity);
+	}
+
+	return normalizeSeverity(scores[0]?.cvss_v3?.baseSeverity);
+}
+
+// --- CSAF file parsing ---
+
+/**
+ * Parses a single CSAF document into zero or more normalized CVE records.
+ * Only records that affect Community Edition are returned.
+ */
+function parseCsafFile(csaf) {
+	const ceIds = collectCeProductIds(csaf.product_tree);
+
+	const date = normalizeDate(csaf.document.tracking.current_release_date);
+
+	const htmlRef = (csaf.document.references || []).find(
+		(r) => r.summary === 'HTML representation'
+	);
+	const link = htmlRef?.url || '';
+
+	const entries = [];
+	for (const vuln of csaf.vulnerabilities || []) {
+		if (!affectsCe(vuln, ceIds)) continue;
+
+		const description =
+			(vuln.notes || []).find((n) => n.category === 'description')?.text || vuln.title || '';
+		const severity = pickSeverity(vuln, ceIds);
+
+		entries.push({
+			id: vuln.cve,
+			severity,
+			date,
+			description,
+			link
+		});
+	}
+	return entries;
+}
+
+// --- Fetch + verify ---
+
+/**
+ * Fetches a CSAF JSON file from the given URL, verifies its SHA-512 checksum,
+ * and returns the parsed JSON object.
+ * Throws on network errors or checksum mismatches.
+ */
+async function fetchAndVerify(url) {
+	const [jsonRes, shaRes] = await Promise.all([fetch(url), fetch(`${url}.sha512`)]);
+
+	if (!jsonRes.ok) throw new Error(`Failed to fetch ${url}: HTTP ${jsonRes.status}`);
+	if (!shaRes.ok)
+		throw new Error(`Failed to fetch checksum for ${url}: HTTP ${shaRes.status}`);
+
+	const jsonText = await jsonRes.text();
+	const shaText = (await shaRes.text()).trim();
+
+	// GNU coreutils ("<hash>  <filename>"), BSD ("SHA512 (file) = <hash>"), or bare hash.
+	const expectedHash = shaText.match(/[0-9a-f]{128}/)?.[0] ?? '';
+
+	const actualHash = crypto.createHash('sha512').update(jsonText).digest('hex');
+
+	if (actualHash !== expectedHash) {
+		throw new Error(
+			`SHA-512 checksum mismatch for ${url}\n` +
+				`  expected: ${expectedHash}\n` +
+				`  actual:   ${actualHash}`
+		);
+	}
+
+	return JSON.parse(jsonText);
+}
+
+// --- Main pipeline ---
+
+/**
+ * Fetches all CSAF advisories, merges with legacy local data,
+ * and writes the result to security.json.
+ */
+export async function fetchAndMerge(logger) {
+	logger?.info('[fetch-csaf] Fetching CSAF index...');
+
+	const indexRes = await fetch(`${CSAF_ROOT}index.txt`);
+	if (!indexRes.ok)
+		throw new Error(`Failed to fetch CSAF index: HTTP ${indexRes.status}`);
+
+	const indexText = await indexRes.text();
+	const advisoryPaths = indexText
+		.split('\n')
+		.map((l) => l.trim())
+		.filter(Boolean);
+
+	logger?.info(`[fetch-csaf] Found ${advisoryPaths.length} advisories in index.`);
+
+	const csafEntries = [];
+	for (const relPath of advisoryPaths) {
+		const url = `${CSAF_ROOT}${relPath}`;
+		logger?.info(`[fetch-csaf] Fetching ${relPath}...`);
+		const csaf = await fetchAndVerify(url);
+		const entries = parseCsafFile(csaf);
+		logger?.info(`[fetch-csaf]   → ${entries.length} CE CVE(s) extracted.`);
+		csafEntries.push(...entries);
+	}
+
+	const legacy = JSON.parse(fs.readFileSync(legacySecurityPath, 'utf8'));
+
+	// Deduplicate by CVE ID (CSAF takes precedence over legacy if both somehow exist)
+	const seen = new Set();
+	const merged = [];
+	for (const entry of [...csafEntries, ...legacy]) {
+		if (!seen.has(entry.id)) {
+			seen.add(entry.id);
+			merged.push(entry);
+		}
+	}
+
+	merged.sort((a, b) => new Date(b.date) - new Date(a.date));
+
+	fs.writeFileSync(outputSecurity, JSON.stringify(merged, null, 2));
+	logger?.info(
+		`[fetch-csaf] Wrote ${outputSecurity} — ` +
+			`${merged.length} total entries (${csafEntries.length} from CSAF, ${legacy.length} legacy).`
+	);
+}
+
+// --- Vite plugin ---
+
+export function fetchCsafPlugin() {
+	let mode = 'production';
+	let viteLogger;
+
+	return {
+		name: 'fetch-csaf',
+
+		configResolved(config) {
+			mode = config.mode;
+			viteLogger = config.logger;
+		},
+
+		async buildStart() {
+			if (mode === 'development') {
+				fs.writeFileSync(outputSecurity, JSON.stringify(DUMMY_ENTRY, null, 2));
+				viteLogger?.info(
+					'[fetch-csaf] Dev mode: writing dummy security entry (no CSAF fetch).'
+				);
+			} else {
+				await fetchAndMerge(viteLogger);
+			}
+		}
+	};
+}
+
+// Allow running as a standalone script: node scripts/fetch-csaf.js
+const isMain =
+	process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(__filename);
+if (isMain) {
+	fetchAndMerge(console).catch((err) => {
+		console.error(err);
+		process.exit(1);
+	});
+}
diff --git a/main/scripts/parse-markdown.js b/main/scripts/parse-markdown.js
index 5439114..9def8b6 100644
--- a/main/scripts/parse-markdown.js
+++ b/main/scripts/parse-markdown.js
@@ -20,9 +20,7 @@ function normalizeDate(dateStr) {
 
 const projectRoot = path.resolve(__dirname, '..');
 const newsDir = path.join(projectRoot, 'src/lib/data/news');
-const securityDir = path.join(projectRoot, 'src/lib/data/security');
 const outputNews = path.join(projectRoot, 'src/lib/data/news.json');
-const outputSecurity = path.join(projectRoot, 'src/lib/data/security.json');
 
 const dateSort = (a, b) => new Date(b.date).getTime() - new Date(a.date).getTime();
 
@@ -43,7 +41,7 @@ function parseMarkdownDir(dirPath, outputFile, fields) {
 export function parseMarkdown() {
 	fs.mkdirSync(path.join(projectRoot, 'src/lib/data'), { recursive: true });
 
-	// --- 1. Parse News ---
+	// Parse News
 	if (fs.existsSync(newsDir)) {
 		parseMarkdownDir(newsDir, outputNews,
 			(file, data, body) => {
@@ -75,34 +73,6 @@ export function parseMarkdown() {
 			}
 		);
 	}
-
-	// --- 2. Parse CVEs ---
-	if (fs.existsSync(securityDir)) {
-		parseMarkdownDir(securityDir, outputSecurity, (file, data, body) => {
-			const id = file.replace('.md', '');
-			const title = data.title || id;
-			const excerpt = data.excerpt || '';
-			const link = data.link || '';
-			const dateStr = data.date || 'Unknown Date';
-
-			let severity = 'moderate';
-			const text = `${title} ${excerpt}`.toLowerCase();
-			if (text.includes('remote code execution') || text.includes('privilege escalation') || text.includes('rce') || text.includes('high severity')) {
-				severity = 'high';
-			} else if (text.includes('low severity') || text.includes('minor')) {
-				severity = 'low';
-			}
-
-			return {
-				id,
-				title,
-				severity,
-				date: normalizeDate(dateStr),
-				description: excerpt || body.trim() || `Security advisory regarding ${title}.`,
-				link
-			};
-		});
-	}
 }
 
 export function parseMarkdownPlugin() {
@@ -113,11 +83,11 @@ export function parseMarkdownPlugin() {
 		},
 		configureServer(server) {
 			const watcher = server.watcher;
-			watcher.add([newsDir, securityDir]);
+			watcher.add([newsDir]);
 			
 			const onChange = (filePath) => {
 				const relativePath = path.normalize(filePath);
-				if (relativePath.startsWith(newsDir) || relativePath.startsWith(securityDir)) {
+				if (relativePath.startsWith(newsDir)) {
 					if (relativePath.endsWith('.md')) {
 						server.config.logger.info(`[parse-markdown] Markdown file changed: ${path.basename(filePath)}. Regenerating JSON...`);
 						try {
diff --git a/main/src/lib/data/legacy-security.json b/main/src/lib/data/legacy-security.json
new file mode 100644
index 0000000..20700ce
--- /dev/null
+++ b/main/src/lib/data/legacy-security.json
@@ -0,0 +1,149 @@
+[
+  {
+    "id": "CVE-2022-30550",
+    "severity": "high",
+    "date": "06 Jul 2022",
+    "description": "Privilege escalation possible in dovecot when similar master and non-master passdbs are used",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2022-July/000477.html"
+  },
+  {
+    "id": "CVE-2020-28200",
+    "severity": "high",
+    "date": "21 Jun 2021",
+    "description": "Sieve excessive resource usage",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html"
+  },
+  {
+    "id": "CVE-2021-29157",
+    "severity": "moderate",
+    "date": "21 Jun 2021",
+    "description": "oauth2 JWT local validation path traversal",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html"
+  },
+  {
+    "id": "CVE-2021-33515",
+    "severity": "moderate",
+    "date": "21 Jun 2021",
+    "description": "SMTP Submission service STARTTLS injection",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html"
+  },
+  {
+    "id": "CVE-2020-24386",
+    "severity": "moderate",
+    "date": "04 Jan 2021",
+    "description": "IMAP hibernation allows accessing other peoples mail",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html"
+  },
+  {
+    "id": "CVE-2020-25275",
+    "severity": "moderate",
+    "date": "04 Jan 2021",
+    "description": "MIME parsing crashes with particular messages",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html"
+  },
+  {
+    "id": "CVE-2020-12100",
+    "severity": "high",
+    "date": "12 Aug 2020",
+    "description": "Receiving mail with deeply nested MIME parts leads to resource exhaustion",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-August/000441.html"
+  },
+  {
+    "id": "CVE-2020-12673",
+    "severity": "moderate",
+    "date": "12 Aug 2020",
+    "description": "Specially crafted NTLM package can crash auth service",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-August/000442.html"
+  },
+  {
+    "id": "CVE-2020-12674",
+    "severity": "moderate",
+    "date": "12 Aug 2020",
+    "description": "Specially crafted RPA authentication message crashes auth",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-August/000443.html"
+  },
+  {
+    "id": "CVE-2020-10957",
+    "severity": "moderate",
+    "date": "18 May 2020",
+    "description": "Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html"
+  },
+  {
+    "id": "CVE-2020-10958",
+    "severity": "moderate",
+    "date": "18 May 2020",
+    "description": "Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html"
+  },
+  {
+    "id": "CVE-2020-10967",
+    "severity": "moderate",
+    "date": "18 May 2020",
+    "description": "Sending mail with empty quoted localpart causes submission or lmtp component to crash.",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html"
+  },
+  {
+    "id": "CVE-2020-7046",
+    "severity": "moderate",
+    "date": "12 Feb 2020",
+    "description": "Truncated UTF-8 can be used to DoS submission-login and lmtp processes",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html"
+  },
+  {
+    "id": "CVE-2020-7957",
+    "severity": "moderate",
+    "date": "12 Feb 2020",
+    "description": "Specially crafted mail can crash snippet generation",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html"
+  },
+  {
+    "id": "CVE-2019-19722",
+    "severity": "moderate",
+    "date": "13 Dec 2019",
+    "description": "Critical vulnerability in Dovecot",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2019-December/000426.html"
+  },
+  {
+    "id": "CVE-2019-11500",
+    "severity": "moderate",
+    "date": "28 Aug 2019",
+    "description": "IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings",
+    "link": "https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html"
+  },
+  {
+    "id": "CVE-2019-11494",
+    "severity": "moderate",
+    "date": "30 Apr 2019",
+    "description": "Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting",
+    "link": "https://dovecot.org/list/dovecot-news/2019-April/000409.html"
+  },
+  {
+    "id": "CVE-2019-11499",
+    "severity": "moderate",
+    "date": "30 Apr 2019",
+    "description": "Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent",
+    "link": "https://dovecot.org/list/dovecot-news/2019-April/000410.html"
+  },
+  {
+    "id": "CVE-2019-10691",
+    "severity": "moderate",
+    "date": "18 Apr 2019",
+    "description": "JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters",
+    "link": "https://dovecot.org/list/dovecot-news/2019-April/000406.html"
+  },
+  {
+    "id": "CVE-2019-7524",
+    "severity": "moderate",
+    "date": "28 Mar 2019",
+    "description": "Buffer overflow when reading extension header from dovecot index files",
+    "link": "https://dovecot.org/list/dovecot-news/2019-March/000403.html"
+  },
+  {
+    "id": "CVE-2019-3814",
+    "severity": "moderate",
+    "date": "05 Feb 2019",
+    "description": "Suitable client certificate can be used to login as other user",
+    "link": "https://dovecot.org/list/dovecot/2019-February/114575.html"
+  }
+]
diff --git a/main/src/lib/data/security/CVE-2019-10691.md b/main/src/lib/data/security/CVE-2019-10691.md
deleted file mode 100644
index 4f04fca..0000000
--- a/main/src/lib/data/security/CVE-2019-10691.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2019-10691
-excerpt: JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters
-link: https://dovecot.org/list/dovecot-news/2019-April/000406.html
-date: 18 Apr 2019
----
-
diff --git a/main/src/lib/data/security/CVE-2019-11494.md b/main/src/lib/data/security/CVE-2019-11494.md
deleted file mode 100644
index a8b6763..0000000
--- a/main/src/lib/data/security/CVE-2019-11494.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2019-11494
-excerpt: Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting
-link: https://dovecot.org/list/dovecot-news/2019-April/000409.html
-date: 30 Apr 2019
----
-
diff --git a/main/src/lib/data/security/CVE-2019-11499.md b/main/src/lib/data/security/CVE-2019-11499.md
deleted file mode 100644
index 467b2be..0000000
--- a/main/src/lib/data/security/CVE-2019-11499.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2019-11499
-excerpt: Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent
-link: https://dovecot.org/list/dovecot-news/2019-April/000410.html
-date: 30 Apr 2019
----
diff --git a/main/src/lib/data/security/CVE-2019-11500.md b/main/src/lib/data/security/CVE-2019-11500.md
deleted file mode 100644
index 8788f32..0000000
--- a/main/src/lib/data/security/CVE-2019-11500.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2019-11500
-excerpt: IMAP and ManageSieve protocol parsers do not properly handle NUL byte when scanning data in quoted strings
-link: https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html
-date: 28 Aug 2019
----
-
diff --git a/main/src/lib/data/security/CVE-2019-19722.md b/main/src/lib/data/security/CVE-2019-19722.md
deleted file mode 100644
index f04f6f6..0000000
--- a/main/src/lib/data/security/CVE-2019-19722.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2019-19722
-excerpt: Critical vulnerability in Dovecot
-link: https://dovecot.org/pipermail/dovecot-news/2019-December/000426.html
-date: 13 Dec 2019
----
diff --git a/main/src/lib/data/security/CVE-2019-3814.md b/main/src/lib/data/security/CVE-2019-3814.md
deleted file mode 100644
index 4cf81f7..0000000
--- a/main/src/lib/data/security/CVE-2019-3814.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2019-3814
-excerpt: Suitable client certificate can be used to login as other user
-link: https://dovecot.org/list/dovecot/2019-February/114575.html
-date: 05 Feb 2019
----
-
diff --git a/main/src/lib/data/security/CVE-2019-7524.md b/main/src/lib/data/security/CVE-2019-7524.md
deleted file mode 100644
index 2e3507b..0000000
--- a/main/src/lib/data/security/CVE-2019-7524.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2019-7524
-excerpt: Buffer overflow when reading extension header from dovecot index files
-link: https://dovecot.org/list/dovecot-news/2019-March/000403.html
-date: 28 Mar 2019
----
-
diff --git a/main/src/lib/data/security/CVE-2020-10957.md b/main/src/lib/data/security/CVE-2020-10957.md
deleted file mode 100644
index f23b986..0000000
--- a/main/src/lib/data/security/CVE-2020-10957.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-10957
-excerpt: Sending malformed NOOP command causes crash in submission, submission-login or lmtp service.
-link: https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html
-date: 18 May 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-10958.md b/main/src/lib/data/security/CVE-2020-10958.md
deleted file mode 100644
index f6243ea..0000000
--- a/main/src/lib/data/security/CVE-2020-10958.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-10958
-excerpt: Sending command followed by sufficient number of newlines triggers a use-after-free bug that might crash submission-login, submission or lmtp service.
-link: https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html
-date: 18 May 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-10967.md b/main/src/lib/data/security/CVE-2020-10967.md
deleted file mode 100644
index e7d7412..0000000
--- a/main/src/lib/data/security/CVE-2020-10967.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-10967
-excerpt: Sending mail with empty quoted localpart causes submission or lmtp component to crash.
-link: https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html
-date: 18 May 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-12100.md b/main/src/lib/data/security/CVE-2020-12100.md
deleted file mode 100644
index d6f3738..0000000
--- a/main/src/lib/data/security/CVE-2020-12100.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2020-12100
-excerpt: Receiving mail with deeply nested MIME parts leads to resource exhaustion
-link: https://dovecot.org/pipermail/dovecot-news/2020-August/000441.html
-date: 12 Aug 2020
----
diff --git a/main/src/lib/data/security/CVE-2020-12673.md b/main/src/lib/data/security/CVE-2020-12673.md
deleted file mode 100644
index 6494cb7..0000000
--- a/main/src/lib/data/security/CVE-2020-12673.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-12673
-excerpt: Specially crafted NTLM package can crash auth service
-link: https://dovecot.org/pipermail/dovecot-news/2020-August/000442.html
-date: 12 Aug 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-12674.md b/main/src/lib/data/security/CVE-2020-12674.md
deleted file mode 100644
index 2dff05a..0000000
--- a/main/src/lib/data/security/CVE-2020-12674.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-12674
-excerpt: Specially crafted RPA authentication message crashes auth
-link: https://dovecot.org/pipermail/dovecot-news/2020-August/000443.html
-date: 12 Aug 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-24386.md b/main/src/lib/data/security/CVE-2020-24386.md
deleted file mode 100644
index a575acd..0000000
--- a/main/src/lib/data/security/CVE-2020-24386.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-24386
-excerpt: IMAP hibernation allows accessing other peoples mail
-link: https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html
-date: 04 Jan 2021
----
-
diff --git a/main/src/lib/data/security/CVE-2020-25275.md b/main/src/lib/data/security/CVE-2020-25275.md
deleted file mode 100644
index b513782..0000000
--- a/main/src/lib/data/security/CVE-2020-25275.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-25275
-excerpt: MIME parsing crashes with particular messages
-link: https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html
-date: 04 Jan 2021
----
-
diff --git a/main/src/lib/data/security/CVE-2020-28200.md b/main/src/lib/data/security/CVE-2020-28200.md
deleted file mode 100644
index 7b041bb..0000000
--- a/main/src/lib/data/security/CVE-2020-28200.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-28200
-excerpt: Sieve excessive resource usage
-link: https://dovecot.org/pipermail/dovecot-news/2021-June/000460.html
-date: 21 Jun 2021
----
-
diff --git a/main/src/lib/data/security/CVE-2020-7046.md b/main/src/lib/data/security/CVE-2020-7046.md
deleted file mode 100644
index 0986db0..0000000
--- a/main/src/lib/data/security/CVE-2020-7046.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-7046
-excerpt: Truncated UTF-8 can be used to DoS submission-login and lmtp processes
-link: https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html
-date: 12 Feb 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2020-7957.md b/main/src/lib/data/security/CVE-2020-7957.md
deleted file mode 100644
index 327f692..0000000
--- a/main/src/lib/data/security/CVE-2020-7957.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2020-7957
-excerpt: Specially crafted mail can crash snippet generation
-link: https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html
-date: 12 Feb 2020
----
-
diff --git a/main/src/lib/data/security/CVE-2021-29157.md b/main/src/lib/data/security/CVE-2021-29157.md
deleted file mode 100644
index a5458ed..0000000
--- a/main/src/lib/data/security/CVE-2021-29157.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2021-29157
-excerpt: oauth2 JWT local validation path traversal
-link: https://dovecot.org/pipermail/dovecot-news/2021-June/000461.html
-date: 21 Jun 2021
----
-
diff --git a/main/src/lib/data/security/CVE-2021-33515.md b/main/src/lib/data/security/CVE-2021-33515.md
deleted file mode 100644
index b6de345..0000000
--- a/main/src/lib/data/security/CVE-2021-33515.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2021-33515
-excerpt: SMTP Submission service STARTTLS injection
-link: https://dovecot.org/pipermail/dovecot-news/2021-June/000462.html
-date: 21 Jun 2021
----
-
diff --git a/main/src/lib/data/security/CVE-2022-30550.md b/main/src/lib/data/security/CVE-2022-30550.md
deleted file mode 100644
index 6d68289..0000000
--- a/main/src/lib/data/security/CVE-2022-30550.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2022-30550
-excerpt: Privilege escalation possible in dovecot when similar master and non-master passdbs are used
-link: https://dovecot.org/pipermail/dovecot-news/2022-July/000477.html
-date: 06 Jul 2022
----
-
diff --git a/main/src/lib/data/security/CVE-2024-23184.md b/main/src/lib/data/security/CVE-2024-23184.md
deleted file mode 100644
index 1f15501..0000000
--- a/main/src/lib/data/security/CVE-2024-23184.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2024-23184
-excerpt: Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive
-link: https://dovecot.org/mailman3/hyperkitty/list/dovecot@dovecot.org/thread/TBZIOBSMJ5G2C5HBJJCE62HW4ETDZF3S/
-date: 14 Aug 2024
----
-
diff --git a/main/src/lib/data/security/CVE-2024-23185.md b/main/src/lib/data/security/CVE-2024-23185.md
deleted file mode 100644
index 4010f08..0000000
--- a/main/src/lib/data/security/CVE-2024-23185.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-title: CVE-2024-23185
-excerpt: Very large headers can cause resource exhaustion when parsing message
-link: https://dovecot.org/mailman3/hyperkitty/list/dovecot@dovecot.org/thread/TEVOFHCKWZW62C6NAM25S3K7CL6KUL2J/
-date: 14 Aug 2024
----
-
diff --git a/main/src/lib/data/security/CVE-2025-30189.md b/main/src/lib/data/security/CVE-2025-30189.md
deleted file mode 100644
index 7f200ae..0000000
--- a/main/src/lib/data/security/CVE-2025-30189.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2025-30189
-excerpt: Using auth caching with oauth2 passdb, passwd passdb or userdb, or passwd userdb, causes the first lookup to be cached for all the lookups.
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2025/oxdc-adv-2025-0001.html
-date: 29 Oct 2025
----
diff --git a/main/src/lib/data/security/CVE-2025-59028.md b/main/src/lib/data/security/CVE-2025-59028.md
deleted file mode 100644
index 9c6306a..0000000
--- a/main/src/lib/data/security/CVE-2025-59028.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2025-59028
-excerpt: Invalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail.
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2025-59031.md b/main/src/lib/data/security/CVE-2025-59031.md
deleted file mode 100644
index 4c995f1..0000000
--- a/main/src/lib/data/security/CVE-2025-59031.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2025-59031
-excerpt: decode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments.
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2025-59032.md b/main/src/lib/data/security/CVE-2025-59032.md
deleted file mode 100644
index 5f6e168..0000000
--- a/main/src/lib/data/security/CVE-2025-59032.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2025-59032
-excerpt: "v2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-0394.md b/main/src/lib/data/security/CVE-2026-0394.md
deleted file mode 100644
index 92379ca..0000000
--- a/main/src/lib/data/security/CVE-2026-0394.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-0394
-excerpt: "auth: Path traversal in passwd-file passdb using %d (domain) escapes base directory and opens /etc/passwdPre-auth path traversal in passwd-file passdb using %d (domain) escapes base directory and opens /etc/passwd. When dovecot has been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has been added to allowed characters, path traversal can happen if the domain component is directory partial. Fixed in v2.4.0."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-24031.md b/main/src/lib/data/security/CVE-2026-24031.md
deleted file mode 100644
index b795b39..0000000
--- a/main/src/lib/data/security/CVE-2026-24031.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-24031
-excerpt: "v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27855.md b/main/src/lib/data/security/CVE-2026-27855.md
deleted file mode 100644
index 9456dd4..0000000
--- a/main/src/lib/data/security/CVE-2026-27855.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27855
-excerpt: "auth: OTP driver vulnerable to replay attack. Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27856.md b/main/src/lib/data/security/CVE-2026-27856.md
deleted file mode 100644
index fcd4953..0000000
--- a/main/src/lib/data/security/CVE-2026-27856.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27856
-excerpt: "doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27857.md b/main/src/lib/data/security/CVE-2026-27857.md
deleted file mode 100644
index c03c7d1..0000000
--- a/main/src/lib/data/security/CVE-2026-27857.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27857
-excerpt: "imap-login: Excessive memory usage DoS. Sending `NOOP (((...)))` command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for longer time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the process and its other proxied connections."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27858.md b/main/src/lib/data/security/CVE-2026-27858.md
deleted file mode 100644
index 3b930c1..0000000
--- a/main/src/lib/data/security/CVE-2026-27858.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27858
-excerpt: managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27859.md b/main/src/lib/data/security/CVE-2026-27859.md
deleted file mode 100644
index 2de7b3b..0000000
--- a/main/src/lib/data/security/CVE-2026-27859.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27859
-excerpt: "v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/src/lib/data/security/CVE-2026-27860.md b/main/src/lib/data/security/CVE-2026-27860.md
deleted file mode 100644
index fd7440f..0000000
--- a/main/src/lib/data/security/CVE-2026-27860.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: CVE-2026-27860.md
-excerpt: "v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication."
-link: https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html
-date: 2026-03-27
----
diff --git a/main/vite.config.ts b/main/vite.config.ts
index 002663a..73e9c94 100644
--- a/main/vite.config.ts
+++ b/main/vite.config.ts
@@ -1,10 +1,11 @@
 import { defineConfig } from 'vite';
 import { parseMarkdownPlugin } from './scripts/parse-markdown.js';
+import { fetchCsafPlugin } from './scripts/fetch-csaf.js';
 import { svelteSitemap } from 'svelte-sitemap/vite';
 import { createViteConfig } from '../packages/shared-ui/vite.config.base.js';
 
 export default defineConfig(async () => {
 	const base = await createViteConfig();
-	const plugins = [...(base.plugins ?? []), parseMarkdownPlugin(), svelteSitemap({ domain: 'https://dovecot.org' })];
+	const plugins = [...(base.plugins ?? []), parseMarkdownPlugin(), fetchCsafPlugin(), svelteSitemap({ domain: 'https://dovecot.org' })];
 	return { ...base, plugins };
 });

From 5e6ae81f87a9746381fc08879eb9849e0a4fe574 Mon Sep 17 00:00:00 2001
From: Michael M Slusarz <slusarz@users.noreply.github.com>
Date: Wed, 16 Sep 2026 13:30:05 -0600
Subject: [PATCH 2/2] Update check-spelling metadata

---
 .github/actions/spelling/expect.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index c71fba1..b0d10af 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -1,6 +1,7 @@
 Admins
 Bento
-CVEs
+coreutils
+csaf
 DFBB
 Dists
 gpgkeys
@@ -13,7 +14,6 @@ onsubmit
 openemailsurvey
 prerender
 proactively
-rce
 sitemap
 SLAs
 splitscreen