CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

EUVD-2026-58169

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

EUVD-2026-58153

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58420

The Git repository management system Gitea is vulnerable to Local File Inclusion (LFI) via the file:// URI in the Migration Restore functionality. The issue originates from the *GiteaLocalUploader.CreateReleases() function within the services/migrations/gitea_uploader.go file. This vulnerability ...

CVE-2026-57894

The Gitea repository management tool is vulnerable to Server-Side Request Forgery (SSRF) via the Clone() function in modules/git/repo.go. The issue arises because the software follows Git HTTP redirects even after initial URL allow/block validation, which can lead to internal git repository exfil...

SUSE CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

SUSE CVE-2026-62420

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/name with migration: true, project: ,...

SUSE CVE-2026-63296

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's...

SUSE CVE-2026-68163

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-73584

The CVE-2026-73584 issue affects sblim-sfcb. A race condition during privileged instance migration allows a local, low-privileged attacker to manipulate a temporary file in /tmp and repeatedly recreate a symlink to redirect privileged output to an arbitrary file, potentially causing privileged fi...

SUSE-SU-2026:3604-1 Security update for kubevirt

This update for kubevirt fixes the following issue: - CVE-2026-13622: virt-handler migration proxy follows symlinks, allowing container escape to host bsc1272840...

PT-2026-71702

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Two Server-Side Request Forgery SSRF issues exist in the migration and mirror functions. These involve DNS rebinding and a lack of re-validation, which could allow an attacker to induce the...

CVE-2026-58442: Exposure of Sensitive Information to an Unauthorized Actor

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-59765: Server-Side Request Forgery (SSRF)

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-58508: Improper Access Control

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58420: Improper Access Control

Local File Inclusion via file:// URI in Migration Restore...

Linux Distros Unpatched Vulnerability : CVE-2026-62420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance...