GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: grype-db, trufflehog-fips, longhorn-cli, syft, drone-fips, amazon-ssm-agent, packer, prometheus, fscrypt, external-secrets-operator, calico-fips, rootlesskit, gitlab-workhorse-ce-fips, podman, mapotf, longhorn-manager-fips, vitess, flux-fips, argo-events-fips,...

GHSA-M43H-MP45-GHQ6 vulnerabilities

Vulnerabilities for packages: seaweedfs, mailpit, bento, pdfcpu, mattermost, ollama, rclone, kubescape, gitea...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: seaweedfs, mailpit, bento, pdfcpu, mattermost, ollama, rclone, kubescape, gitea...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, wal-g, buildkitd, gatus, terraform-provider-tls, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, eksctl, fscrypt, step, external-dns, neuvector-sigstore-interface,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argocd-image-updater, containerd, snyk-cli, mattermost, aactl, k3s, zot, zarf, prometheus-operator, kine, loki, osv-scanner, kots, chisel, gitea, kubernetes-dashboard, flux-image-automation-controller, kyverno, flux-source-controller, k9s,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argocd-image-updater, containerd, snyk-cli, mattermost, aactl, k3s, zot, zarf, prometheus-operator, docker-machine-driver-harvester, kine, loki, osv-scanner, kots, chisel, gitea, kubernetes-dashboard, flux-image-automation-controller,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-language-yaml, mattermost, k3s, osv-scanner, kubernetes-dashboard, spire-server, opentelemetry-collector, cert-manager, grype, fscrypt, step, external-dns, knative-serving, argo-cd, flux, argo-events, cloud-provider-aws, skaffold, terragrunt, kine,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, argocd-image-updater, chezmoi, containerd, snyk-cli, pulumi-language-yaml, nfpm, pulumi-language-java, act, witness, mattermost, terragrunt, aactl, k3s, pulumi-kubernetes-operator, gptscript, zot, zarf, prometheus-operator, kine, loki,...

ROS-20260626-73-0004

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

GO-2026-5721 Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes in code.gitea.io/gitea

Gitea: Public-only tokens bypass private-resource restrictions on /api/v1/user self routes in code.gitea.io/gitea...

GO-2026-5510 Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo in code.gitea.io/gitea...

GO-2026-5448 Gitea: Open Redirect via redirect_to in code.gitea.io/gitea

Gitea: Open Redirect via redirectto in code.gitea.io/gitea...

GO-2026-5321 Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea

Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens in code.gitea.io/gitea...

GO-2026-5299 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea

Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea...

GO-2026-5365 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea

Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea...

GO-2026-5286 Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer in code.gitea.io/gitea

Gitea: Stored XSS via glTF extensionsRequired in Gitea 3D File Viewer in code.gitea.io/gitea...

GO-2026-5334 Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea

Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea...

GO-2026-5243 Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw in code.gitea.io/gitea...

GO-2026-5091 Gitea has insecure default SSH settings in code.gitea.io/gitea

Gitea has insecure default SSH settings in code.gitea.io/gitea...

GO-2026-5081 Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea

Gitea: Missing repository-unit authorization on issue-template API endpoints in code.gitea.io/gitea...