From 072523a578c1610dde31f48e0b1ecb0891cbc111 Mon Sep 17 00:00:00 2001
From: pulpbot <pulp-infra@redhat.com>
Date: Fri, 9 Oct 2026 03:24:07 +0000
Subject: [PATCH] Update Changelog

---
 CHANGES.md | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 4d5c3d5b..f3d8754c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,14 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.37.1 (2026-10-08) {: #3.37.1 }
+
+#### Bugfixes {: #3.37.1-bugfix }
+
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.37.0 (2026-10-07) {: #3.37.0 }
 
 #### Features {: #3.37.0-feature }
@@ -29,6 +37,14 @@
 
 ---
 
+## 3.36.4 (2026-10-08) {: #3.36.4 }
+
+#### Bugfixes {: #3.36.4-bugfix }
+
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.36.3 (2026-10-07) {: #3.36.3 }
 
 #### Bugfixes {: #3.36.3-bugfix }
@@ -256,6 +272,14 @@
 
 ---
 
+## 3.27.7 (2026-10-08) {: #3.27.7 }
+
+#### Bugfixes {: #3.27.7-bugfix }
+
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.27.6 (2026-07-16) {: #3.27.6 }
 
 #### Bugfixes {: #3.27.6-bugfix }
@@ -510,6 +534,15 @@
 
 ---
 
+## 3.19.5 (2026-10-08) {: #3.19.5 }
+
+#### Bugfixes {: #3.19.5-bugfix }
+
+- Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.19.4 (2026-06-30) {: #3.19.4 }
 
 #### Bugfixes {: #3.19.4-bugfix }
@@ -641,6 +674,15 @@ No significant changes.
 
 ---
 
+## 3.13.8 (2026-10-08) {: #3.13.8 }
+
+#### Bugfixes {: #3.13.8-bugfix }
+
+- Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.13.7 (2026-06-30) {: #3.13.7 }
 
 #### Bugfixes {: #3.13.7-bugfix }
@@ -723,6 +765,15 @@ No significant changes.
 
 ---
 
+## 3.12.10 (2026-10-08) {: #3.12.10 }
+
+#### Bugfixes {: #3.12.10-bugfix }
+
+- Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.12.9 (2026-04-01) {: #3.12.9 }
 
 #### Bugfixes {: #3.12.9-bugfix }
@@ -823,6 +874,15 @@ No significant changes.
 
 ---
 
+## 3.11.9 (2026-10-08) {: #3.11.9 }
+
+#### Bugfixes {: #3.11.9-bugfix }
+
+- Fixed quoting mistake in simple html detail pages that can lead to a possible XSS attack.
+- Fixed quoting mistake in simple html index pages that can lead to a possible XSS attack given a carefully crafted package name. CVE-2026-103871
+
+---
+
 ## 3.11.8 (2026-04-21) {: #3.11.8 }
 
 No significant changes.