[GHSA-pghw-ch4m-h3f9] Add finder credit and fix reference (CVE-2026-78367) - #9647

Thanks! Aside from the credit, would the curation team be able to consider this advisory for review (i.e., upgrade it from the NVD mirror entry to a reviewed advisory)? It affects a system/distro package (rpm), so I understand ecosystem version-range mapping may be limited, but happy to help with any additional information (affected versions, fixed versions, references) that makes the review possible.

Note on affected: intentionally left empty — rpm is a C-level OS package outside the supported ecosystems. The fix (commit 2a11eb3e4e51094082e0123aebd797ec051dc094, "Prevent command injection via rpmbuild -t", 2026-09-03) landed on main after the 6.1.0 release (2026-08-20), so no fixed release exists yet; the range can be added once one ships. Thanks!