CVE-2026-48719

creationtimestamp| type| source ---|---|--- 2026-06-24 21:30:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2uesniqb2l...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

CVE-2025-64719

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface...

CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-33543 FOSSBilling: Authentication bypass allows unauthenticated administrator creation

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already...

CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-53117

creationtimestamp| type| source ---|---|--- 2026-06-24 18:55:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2lqfxdsf2o...

CVE-2026-53121

creationtimestamp| type| source ---|---|--- 2026-06-24 18:32:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2kh5tlkn2t 2026-07-23 21:26:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdroo4zxs2y...

CVE-2026-48720

Warp is an agentic development environment. From 0.2025.03.05.08.02.stable00 until 0.2026.05.06.15.42.stable01, Warp accepts non-inline OSC 1337;File payloads from terminal output and materialize the decoded payload as a local file without an additional confirmation step. This vulnerability is...

CVE-2026-53129

creationtimestamp| type| source ---|---|--- 2026-06-24 18:16:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2jkgsgap2i...

CVE-2026-11878

creationtimestamp| type| source ---|---|--- 2026-06-24 17:40:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2hj6q7od23 2026-07-20 05:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2l7zmipy2l...

CVE-2019-12768

creationtimestamp| type| source ---|---|--- 2026-06-24 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp2hdkb6tm2h...

CVE-2026-52979

In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc pspassocdevicegetlocked obtains a pspdev reference via pspdevgetforsock which uses pspdevtryget under RCU; it then acquires psd-lock and drops the reference. Before the lo...

CVE-2026-52979

In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc pspassocdevicegetlocked obtains a pspdev reference via pspdevgetforsock which uses pspdevtryget under RCU; it then acquires psd-lock and drops the reference. Before the lo...

CVE-2026-52979 net: psp: check for device unregister when creating assoc

In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc pspassocdevicegetlocked obtains a pspdev reference via pspdevgetforsock which uses pspdevtryget under RCU; it then acquires psd-lock and drops the reference. Before the lo...

CVE-2026-52979

CVE-2026-52979 is a Linux kernel vulnerability in the PSP subsystem. The issue arises in psp_assoc_device_get_locked(): it takes a psp_dev reference via psp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU), then acquires psd->lock and drops the registration reference. If psp_dev_unre...