ANT-2026-VN61PHA0 · gitea · IDOR

idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...

CVE-2026-72410

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gitleaks, kube-bench, sops, k8sgateway, vale, sftpgo-plugin-pubsub, azure-workload-identity-webhook, golangci-lint, ferretdb, ipfs-cluster, chart-testing, crossplane-provider-aws-firehose, dynamic-localpv-provisioner, mongodb-kubernetes-operator, traefik,...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea's LFS server is vulnerable to a privilege escalation flaw due to a trust-boundary confusion in how it handles deploy keys . The system incorrectly sets the UserID in LFS JWT tokens to the repository owner's ID rather than the specific deploy key's identity. Consequently, an attacker possess...

EUVD-2026-58162

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435: Incorrect Privilege Assignment

Gitea LFS Deploy-Key Privilege Escalation...

SUSE CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.2 (AXSA:2026-1500:11)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1500:11 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

CLEANSTART-2026-CS42741 Security fixes in git-lfs 3.7.0-r1

Package git-lfs version 3.7.0-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-QB92274 Security fixes in git-lfs 3.7.0-r3

Package git-lfs version 3.7.0-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CLEANSTART-2026-XM62269 Security fixes in git-lfs-fips 3.7.0-r2

Package git-lfs-fips version 3.7.0-r2 fixes 11 vulnerabilities: CVE-2025-47911, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2025-61730...

CLEANSTART-2026-QQ25603 Security fixes in git-lfs 3.1.2-r3

Package git-lfs version 3.1.2-r3 fixes 1 vulnerabilities: CVE-2021-38561...

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5. A patched version of the package is available...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...