deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

xz-utils-backdoor-case-study

XZ Utils Backdoor Technical Case Study — How Maintainer Trust Became a Supply-Chain Execution Path When maintainer trust became the attack path. Overview CASE-002 reconstructs the XZ Utils / liblzma backdoor disclosed on 29 March 2024 as CVE-2024-3094. The report follows the operation from...

CVE-2024-3094

Good evening, I would like to inform you about a critical security issue that has been identified and directly affects the Linux community, including servers and Android devices. It was discovered that one of the contributors, known by the name of Jesse, has been distributing corrupted binaries...

Review.CVE-2023-5612

CVE-2023-5612 – GitLab SSRF via Webhook URL PoC & Analysis 📌 CVE Overview CVE-ID: CVE-2023-5612 Severity: High CVSS: 8.1 Base Score Type: Server-Side Request Forgery SSRF Component: GitLab CE/EE Webhooks Affected Versions: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888" ...

BIT-GITEA-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

CVE-2026-103549

GitLab CE/EE versions 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are vulnerable to an improper authorization check within the package registry . Under certain conditions, an authenticated user with maintainer-role permissions could remove specific package registry metadata tha...

CVE-2026-103549 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that...

CVE-2026-103549 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that...

CVE-2026-103549 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that...

CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

CVE-2026-94205

A flaw in Gitea Actions allows for an approval bypass when handling fork pull requests. The system incorrectly determines if a workflow run requires approval by checking the identity of the user who triggered the event (e.g., a maintainer adding a label during triage) rather than the pull request...

CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

Review.CVE-2023-5612

CVE-2023-5612 – SSRF di GitLab tramite URL Webhook PoC e Analisi 📌 Panoramica CVE ID CVE: CVE-2023-5612 Gravità: Alta CVSS: 8.1 Punteggio Base Tipo: Server-Side Request Forgery SSRF Componente: Webhook di GitLab CE/EE Versioni Affette: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888"...

EUVD-2026-80249

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

PT-2026-93361

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Owner or Maintainer permissions can silently disable protected...

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...