THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,904 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-68964 — Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restri…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can retrieve public keys, key titles, fingerprints, and GPG-embedded email addresses belonging to Limited-visibility users. The disclosure concerns public key material and associated metadata, not private cryptographic keys.
CVE-2026-68964Read original ↗ (opens in a new tab) - NVD
CVE-2026-68957 — Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibil…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.
CVE-2026-68957Read original ↗ (opens in a new tab) - NVD
CVE-2026-67577 — Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted account…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. A restricted user can retrieve activity records and contribution timestamps that the corresponding profile routes deny. Exposed activity can include repository names, commit messages, and issue or pull request events associated with qualifying public-repository activity.
CVE-2026-67577Read original ↗ (opens in a new tab) - NVD
CVE-2026-66877 — Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-c…
High · CVSS 3.1 8.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.
CVE-2026-66877Read original ↗ (opens in a new tab) - NVD
CVE-2026-66874 — For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status wh…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for th…
CVE-2026-66874Read original ↗ (opens in a new tab) - NVD
CVE-2026-66853 — Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without a…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.
CVE-2026-66853Read original ↗ (opens in a new tab) - NVD
CVE-2026-66849 — Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without exclud…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. A restricted user can enumerate and download those packages despite the visibility policy that should prevent this access. The issue affects user-owned package registries and exposes package contents across the intended authorization boundary.
CVE-2026-66849Read original ↗ (opens in a new tab) - NVD
CVE-2026-63792 — Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull re…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.
CVE-2026-63792Read original ↗ (opens in a new tab) - NVD
CVE-2026-63021 — Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate s…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
CVE-2026-63021Read original ↗ (opens in a new tab) - NVD
CVE-2026-62925 — Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data o…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.
CVE-2026-62925Read original ↗ (opens in a new tab) - NVD
CVE-2026-60021 — Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task'…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
CVE-2026-60021Read original ↗ (opens in a new tab) - NVD
CVE-2026-60018 — Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a cli…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.
CVE-2026-60018Read original ↗ (opens in a new tab) - NVD
CVE-2026-60010 — Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organizat…
Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
CVE-2026-60010Read original ↗ (opens in a new tab) - NVD
CVE-2026-60008 — Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabl…
Low · CVSS 3.1 3.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.
CVE-2026-60008Read original ↗ (opens in a new tab) - NVD
CVE-2026-59774 — Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing…
Critical · CVSS 3.1 9.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
CVE-2026-59774Read original ↗ (opens in a new tab) - NVD
CVE-2026-59766 — Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning da…
Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and private issue titles through /api/v1/user/times. The disclosure depends on relationships or tracked-time entries created before access was revoked.
CVE-2026-59766Read original ↗ (opens in a new tab) - NVD
CVE-2026-53613 — util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42…
High · CVSS 3.1 7.0 · Assessor: [email protected]
util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized m…
CVE-2026-53613Read original ↗ (opens in a new tab) - NVD
CVE-2026-53612 — util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `m…
High · CVSS 3.1 7.0 · Assessor: [email protected]
util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the pri…
CVE-2026-53612Read original ↗ (opens in a new tab) - NVD
CVE-2026-25946 — When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating…
Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0
When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. An unauthenticated remote attacker can cause the server to contact loopback or private-network HTTP services. This can expose internal service behavior and enable interaction with resources that are not directly reachable by the attacker.
CVE-2026-25946Read original ↗ (opens in a new tab) - NVD
CVE-2026-15176 — A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive toget…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in…
CVE-2026-15176Read original ↗ (opens in a new tab) - NVD
CVE-2026-110650 — The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
CVE-2026-110650Read original ↗ (opens in a new tab) - NVD
CVE-2026-110649 — Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supp…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
CVE-2026-110649Read original ↗ (opens in a new tab) - NVD
CVE-2026-110648 — @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell…
High · CVSS 4.0 8.5 · Assessor: [email protected]
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
CVE-2026-110648Read original ↗ (opens in a new tab) - NVD
CVE-2026-110647 — Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by su…
High · CVSS 4.0 8.5 · Assessor: [email protected]
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
CVE-2026-110647Read original ↗ (opens in a new tab) - NVD
CVE-2026-110646 — Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers t…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
CVE-2026-110646Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.