CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

PT-2026-31657

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

oma 注入漏洞

Oma is an AOSC-Dev open-source package manager for AOSC OS. Versions of Oma prior to 1.25.2 had a injection vulnerability. This vulnerability stemmed from Oma-topics not checking the transliterated value of the name field in metadata, which could allow malicious APT source entries to be added to...

BIT-GITEA-2025-69413

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

PT-2026-1000

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.2 Description Gitea versions before 1.25.2 are affected by an issue where the /api/v1/user endpoint provides differing responses for authentication failures based on the existence of a username. Specifically, the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when deleting releases. Remediation Upgrade github.com/go-gitea/gitea/services/release to version 1.25.2 or higher. References - Gitea Release - GitHub Commit - GitHub PR - GitHub PR - GitHub Release - Red Hat...

Gitea mishandles authorization for deletion of releases

Gitea before 1.25.2 mishandles authorization for deletion of releases...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when deleting releases. Remediation Upgrade code.gitea.io/gitea/services/release to version 1.25.2 or higher. References - Gitea Release - GitHub Commit - GitHub PR - GitHub PR - GitHub Release - Red Hat Bugzilla...

CVE-2025-68938

Gitea before 1.25.2 mishandles authorization for deletion of releases...

CVE-2025-68938

Gitea before 1.25.2 mishandles authorization for deletion of releases...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea versions prior to 1.25.2, which stems from improper authorization handling when removing releases...

PT-2025-53433

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.2 Description The software does not properly manage permissions when deleting releases. This can allow unauthorized deletion of releases. Recommendations Update to version 1.25.2 or later...

UBUNTU-CVE-2020-7212

The encodeinvalidchars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service CPU consumption because of an inefficient algorithm. The percentencodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length ...