CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

GO-2026-6073 Gitea LFS Deploy-Key Privilege Escalation in gitea.dev

Gitea LFS Deploy-Key Privilege Escalation in gitea.dev...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

CVE-2026-58065

The Apache Airflow Git provider runs its git-over-SSH operations with StrictHostKeyChecking=no by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server man-in-the-middle, capturing the S...

CVE-2026-58065

The CVE affects the Apache Airflow Git provider when performing git-over-SSH operations with StrictHostKeyChecking=no, which disables SSH host-key verification and enables MITM risk between an Airflow worker and the Git server. Deployments that clone over SSH using a deploy key or involve the Git...

EUVD-2025-180173

Malicious code in awk-sun-deploy-key-omega npm...

EUVD-2022-25250

Malicious code in bioql PyPI...

EUVD-2023-44168

Malicious code in bioql PyPI...

EUVD-2022-34385

Malicious code in bioql PyPI...

EUVD-2024-32056

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-2095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all...

Linux Distros Unpatched Vulnerability : CVE-2022-1983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker...

CVE-2023-3509

An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privately accessible deploy keys associated...

CVE-2022-1983

Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP...

CVE-2022-2095

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint a...

Gitlab -- vulnerabilities

Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Keys can push changes to an archived repository Guests can disclose project templates GitLab instanc...