GHSA-5GF7-WJFM-VMVM

creationtimestamp| type| source ---|---|--- 2026-06-25 00:01:29+00:00| seen| https://bsky.app/profile/slackers.it/post/3mp34su7fvx26...

PT-2026-52566

Name of the Vulnerable Software and Affected Versions Mattermost Google Drive plugin versions prior to 1.1.0 Description An improper access control issue exists where the plugin fails to validate channel membership in the file creation endpoint. This allows authenticated users with a connected...

PT-2026-52537

Name of the Vulnerable Software and Affected Versions File Browser versions 2.0.0-rc.1 and later Description When configured with proxy authentication auth.method=proxy, the software improperly trusts upstream identity headers without validating that requests originate from a trusted proxy. An...

PT-2026-52643

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authorization bypass exists in the StrictRolePermission and AuthorityCreatorPermission classes within lemur/auth/permissions.py. When the configuration flags LEMUR STRICT ROLE ENFORCEMENT an...

CVE-2026-9620

creationtimestamp| type| source ---|---|--- 2026-06-24 23:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp32bpkatu2v...

CVE-2026-47733

creationtimestamp| type| source ---|---|--- 2026-06-24 22:29:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xnkkgdz25...

CVE-2026-52797

creationtimestamp| type| source ---|---|--- 2026-06-24 22:27:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xjwx3ej2f...

CVE-2020-14068

creationtimestamp| type| source ---|---|--- 2026-06-24 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp2wgdt2t22m...

GHSA-434X-W66G-QW3R

creationtimestamp| type| source ---|---|--- 2026-06-24 21:41:59+00:00| seen| https://gist.github.com/moonpiedumplings/7e71121b76c58ecaba4176be9bb827c4...

CVE-2026-57301

creationtimestamp| type| source ---|---|--- 2026-06-24 21:41:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2uxprae32o 2026-07-01 01:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpkdbq6jqu2l...

CVE-2026-48719

creationtimestamp| type| source ---|---|--- 2026-06-24 21:30:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2uesniqb2l...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the ENABLEREVERSEPROXYAUTHENTICATION process. An attacker can impersonate any user or trigger automatic account creation by forging the configured authentication header in client requests. This is only exploitable...

CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2025-64719

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface...

CVE-2026-33543 FOSSBilling: Authentication bypass allows unauthenticated administrator creation

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already...

CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...

CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLEREVERSEPROXYAUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originated from a trusted reverse proxy. A...