CVE-2026-96400

Gitea is vulnerable to a Server-Side Request Forgery (SSRF) during migrations. If [migrations] ALLOWED_DOMAINS is configured with a wildcard (e.g., *), the application may permit requests to reserved and link-local addresses like 169.254.169.254, even if ALLOW_LOCALNETWORKS is set to false. This ...

CVE-2026-101027

A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea during repository migrations. When [migrations] ALLOWED_DOMAINS is configured, the system fails to verify if a resolved hostname matches local-network restrictions. An attacker who can initiate migrations and control the DNS of an...

CVE-2026-6689: Missing Authorization

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation the check was only applied on update/patch, which allows an authenticated user holding...