Merge pull request #1209 from jasnow/camaleon_cms-patched

Patch released for CVE-2026-1776

@simi - Thanks for reviewing and approved PR.

Author: jasnow

gems/camaleon_cms/CVE-2026-1776.yml

@@ -24,12 +24,23 @@ cvss_v3: 6.5
 cvss_v4: 6.0
 unaffected_versions:
   - "< 2.4.5.0"
-notes: 'Never patched; last release was 2.9.1'
+patched_versions:
+  - ">= 2.9.2"
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-1776
+    - https://rubygems.org/gems/camaleon_cms/versions/2.9.2
+    - https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
     - https://github.com/owen2345/camaleon-cms/pull/1127
     - https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af
     - https://camaleon.website
     - https://www.vulncheck.com/advisories/camaleon-cms-aws-uploader-authenticated-path-traversal-arbitrary-file-read
     - https://github.com/advisories/GHSA-jw5g-f64p-6x78
+notes: |
+  - Note that the rubygem name is "camaleon_cms" and
+    repo name is "camaleon-cms".
+  - Found PR#1127 (from GHSA and nvd.nist.gov) in
+    https://github.com/owen2345/camaleon-cms/releases/tag/2.9.2
+    release notes.
+  - cvss_v3 from nvd.nist.gov URL.
+  - cvss_v4 from GHSA and nvd.nist.gov URLs.