PrivateSphare

PrivateSphare PrivateSphare è una piattaforma sicura, anonima e a conoscenza zero per l'archiviazione e la condivisione di file. Consente agli utenti di caricare file e ricevere una passphrase leggibile di 24 parole per il recupero. Nessun account, nessun tracciamento e nessun dato non...

gapps

Gapps Gapps è una piattaforma di conformità alla sicurezza che semplifica il monitoraggio dei tuoi progressi rispetto a vari framework di sicurezza. ❄️ Visita il sito di Gapps 🏠 Sei interessato a contattarmi? Unisciti al nostro Discord Indice 1. Per iniziare 2. FAQ Nuove funzionalità ❄️ SOC2, NIST...

CVE-2025-46822

CVE-2025-46822 Lettura Arbitraria di File non Autenticata tramite Percorso Assoluto Descrizione: Mentre il metodo Path.resolve viene utilizzato per proteggere dal path traversal, ho scoperto che l'uso di un percorso assoluto riesce a leggere con successo i file interni; l'endpoint inoltre non è...

coolify-cve-2025-66209-66213

Coolify Security Advisories - CVE-2025-66209 bis CVE-2025-66213 Melder: 0xrakan Hersteller: coollabsio/coolify Betroffene Versionen: v4.0.0-beta.451 Behobene Version: v4.0.0-beta.451 Schweregrad: Kritisch CVSS 9,4 Überblick Fünf kritische, authentifizierte Command-Injection-Schwachstellen wurden ...

CVE-2026-17556

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

SUSE CVE-2026-52812

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone /// but per-repo authorization lives in the lfsobject table keyed repoid, oid. serveUpload skips re-uploading when the OID file already exists on disk and inserts a new repoid, oid r...

GO-2026-6073 Gitea LFS Deploy-Key Privilege Escalation in gitea.dev

Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...

PT-2026-63400

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...

git-lfs security update

3.7.1-6 - Rebuild with new Golang 3.7.1-5 - Fix CVE-2026-39821 in vendored golang.org/x/net idna package 3.7.1-4 - Rebuild with new Golang...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

GHSA-7WVC-RVP7-W99X Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...

RLSA-2026:39272 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, video...

RLSA-2026:39319 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME...