CVE-2026-116289 Gitea public-only token bypass through Actions runner registration

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

EUVD-2026-114794

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit...

CVE-2026-118386

In Gitea , a logic flaw in review-triggered workflows allows an attacker with read access to execute unauthorized code. The system fails to verify that the commit referenced in a review's commit_id belongs to the reviewed pull request. By submitting a review that points to a malicious commit (via...

CVE-2026-116289: Gitea: Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions…

Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...

CVE-2026-118386: Gitea: Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the…

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

CVE-2026-15343 Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/, because path validation did...

MSC-2026-6085

Official "@redhat-cloud-services" npm packages were compromised and republished on 2026-06-01 via the "RedHatInsights/javascript-clients" GitHub Actions OIDC publishing flow. Each malicious version registers a "preinstall" hook that fires automatically on "npm install" and executes a multi-stage...

CVE-2021-22862

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference ...

EUVD-2021-9997

Malicious code in bioql PyPI...

CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2021-22862

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference ...

CVE-2021-22862

GitHub Enterprise Server 3.0.0, 3.0.0.rc2, and 3.0.0.rc1 are affected by an improper access control vulnerability that lets an authenticated user who can fork a repository disclose Actions secrets from the parent repository. The root cause is a flaw that allows the base reference of a PR to be up...

CVE-2021-22862 Improper access control in GitHub Enterprise Server leading to the disclosure of Actions secrets to forks

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference ...

CVE-2021-22862: Improper Authorization

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with the ability to fork a repository to disclose Actions secrets for the parent repository of the fork. This vulnerability existed due to a flaw that allowed the base reference ...