CVE-2026-116289

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289

Gitea fails to reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint. Because the resulting runner is not restricted to public repositories, an attacker possessing a write:organization token belonging to a public ...

CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-116289: Gitea: Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions…

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CLEANSTART-2026-DJ95969 Security fix for GHSA-f6x5-jh6r-wrfv applied in: gatekeeper 3.20.1-r0, kyverno-policy-reporter-ui-fips 2.4.4-r0, prometheus-alertmanager-fips 0.29.0-r1, actions-runner-controller 0.13.0-r1, nodetaint 0.0.4-r1, trivy 0.67.2-r0, nats-server-fips 2.11.11-r1, nats-server-fips 2.9.25-r1, alertmanager-fips 0.29.0-r1, nats-server-fips 2.10.29-r2, falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, cloudflared 2025.11.1-r1, go-fips-1.24 1.24.12-r0, gitaly 14-9-3-r0, gitaly-fips 14.9.3-r0

GHSA-f6x5-jh6r-wrfv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LY21746 Security fix for GHSA-j5w8-q4gc-rx2x applied in: actions-runner-controller 0.13.0-r1

Security vulnerability affects the actions-runner-controller package. This issue is resolved in later releases. See references for vulnerability details...

GHSA-RXP7-6HXX-X8Q5 vulnerabilities

Vulnerabilities for packages: unleash, eco-jess, lerna, npm, code-server, unleash-proxy, homepage, wazuh-dashboard, prism, wazuh-dashboard-fips, actions-runner, graalvm, renovate, node-red...

CVE-2026-111997 vulnerabilities

Vulnerabilities for packages: unleash, eco-jess, lerna, npm, code-server, unleash-proxy, homepage, wazuh-dashboard, prism, wazuh-dashboard-fips, actions-runner, graalvm, renovate, node-red...

GHSA-P3HM-X653-5RC6 vulnerabilities

Vulnerabilities for packages: unleash, eco-jess, lerna, npm, code-server, unleash-proxy, homepage, wazuh-dashboard, prism, wazuh-dashboard-fips, actions-runner, graalvm, renovate, node-red...

GHSA-846F-F764-76MX vulnerabilities

Vulnerabilities for packages: dotnet-sdk, promitor, dotnet-sdk-stage0, ilspycmd, dotnet, eco-dotnet-apidiff, actions-runner...

CVE-2026-70162 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, promitor, dotnet-sdk-stage0, ilspycmd, dotnet, eco-dotnet-apidiff, actions-runner...

CVE-2026-84008 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, promitor, dotnet-sdk-stage0, ilspycmd, dotnet, eco-dotnet-apidiff, actions-runner...

GHSA-2FMV-RV2C-59X7 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, promitor, dotnet-sdk-stage0, ilspycmd, dotnet, eco-dotnet-apidiff, actions-runner...

GO-2026-6613 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, smarter-device-manager, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, falco-exporter, aws-otel-collector, k3d, argo-cd, metrics-agent...

CVE-2026-94439 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, smarter-device-manager, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, falco-exporter, aws-otel-collector, k3d, argo-cd, metrics-agent...

GHSA-874M-FCC5-9GQF vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, smarter-device-manager, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, falco-exporter, aws-otel-collector, k3d, argo-cd, metrics-agent...

GO-2026-6607 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, falco-exporter, aws-otel-collector, k3d, argo-cd, pguser, metrics-agent, hubble-ui,...

GO-2026-6605 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, aws-otel-collector, k3d, argo-cd, metrics-agent, hubble-ui, k8sgpt, zarf,...

CVE-2026-97031 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kserve-modelmesh-serving, newrelic-infra-operator, portieris, trufflehog, azure-service-operator, authservice, grafana-image-renderer, apache-exporter, falco-exporter, aws-otel-collector, k3d, argo-cd, pguser, metrics-agent, hubble-ui,...