2434 matches found
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...
CVE-2026-66381
Technical details are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-57250
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...
CVE-2026-66381 Repository readers may access content outside configured upstream paths
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...
PT-2026-71105
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...
PT-2026-70055
Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description A flaw allows a remote attacker with 'deployer' account authentication to import and deploy a malicious archive file from an untrusted source. By leveraging WildFly libraries to create a...
CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...
CVE-2026-70375
CVE-2026-70375 : HashBrown CMS <1.4.6 has an OS Command Injection in the Git deployer. GitDeployer.pullRepo() runs AppService.exec(git checkout ${this.branch || 'master'}) with the branch value interpolated directly, and GitDeployer.validate() only rejects a single quote in repo/branch/usernam...
CVE-2026-10569
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...
CVE-2026-10569
IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by CVE-2026-10569 due to exposure of sensitive information in plugin output logs. Affected products/versions: UCD 7.2–7.2.3.23; 7.3–7.3.2.18; DevOps Deploy 8.0–8.0.1.13; 8.1–8.1.2.6; 8.2–8.2.1.0. Root cause: plugin output logs may reve...
CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...
EUVD-2026-51275
IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...
GO-2026-6073 Gitea LFS Deploy-Key Privilege Escalation in gitea.dev
Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...
CVE-2026-12702
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...
CVE-2026-12702
In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...
