773 matches found
CVE-2026-79653
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...
CVE-2026-79653
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...
CVE-2026-79653
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...
CVE-2026-79653
In Eclipse SW360 versions 19.0.0 through 20.1.0 , when the system is configured to store attachments on the file system via the config key enable.attachment.store.to.file.system , an authenticated attacker can manipulate the filename during upload to achieve arbitrary file path traversal . The CV...
CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints
ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...
GHSA-MMJ4-63M4-R6H5 CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe extension check, such as extin on patched...
CVE-2026-17556
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...
Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...
MAL-2026-12167 Malicious code in bigops-file-storage (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff4d23505ef5dd8a734e25b08b9b86a98bdf482482a2dbffcdf34f1467a2aa82 On require of bigops-file-storage, index.js loads vendor.js which selects a platform-specific asset path, fetches an opaque native binary over HTTPS...
SUSE CVE-2026-28740
Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access...
SUSE CVE-2026-52812
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone /// but per-repo authorization lives in the lfsobject table keyed repoid, oid. serveUpload skips re-uploading when the OID file already exists on disk and inserts a new repoid, oid r...
CLEANSTART-2026-YO09216 Security fixes in git-lfs 3.1.2-r4
Package git-lfs version 3.1.2-r4 fixes 1 vulnerabilities: CVE-2022-27191...
GO-2026-6073 Gitea LFS Deploy-Key Privilege Escalation in gitea.dev
Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...
PT-2026-65370
Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...
git-lfs security update
3.7.1-6 - Rebuild with new Golang 3.7.1-5 - Fix CVE-2026-39821 in vendored golang.org/x/net idna package 3.7.1-4 - Rebuild with new Golang...
PT-2026-63400
Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description A path traversal issue exists in the file-based persistence storage provider. This occurs when the storage key is derived from user-controlled input, which can lead to...
Gitea LFS Deploy-Key Privilege Escalation
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...
GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...