CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

EUVD-2026-58162

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea's LFS server is vulnerable to a privilege escalation flaw due to a trust-boundary confusion in how it handles deploy keys . The system incorrectly sets the UserID in LFS JWT tokens to the repository owner's ID rather than the specific deploy key's identity. Consequently, an attacker possess...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435: Incorrect Privilege Assignment

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-66381

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-57250

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

PT-2026-71105

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions. Recommendations At the moment,...

CVE-2026-66381: Improper Limitation of a Pathname to a Restricted Directory

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

SUSE CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

PT-2026-70055

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description A flaw allows a remote attacker with 'deployer' account authentication to import and deploy a malicious archive file from an untrusted source. By leveraging WildFly libraries to create a...

CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-70375

CVE-2026-70375 : HashBrown CMS <1.4.6 has an OS Command Injection in the Git deployer. GitDeployer.pullRepo() runs AppService.exec(git checkout ${this.branch || 'master'}) with the branch value interpolated directly, and GitDeployer.validate() only rejects a single quote in repo/branch/usernam...

CVE-2026-70375

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

Malicious code in ember-cli-deploy-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e75fdf3524b33e98181630b607b31f8d9f45b24cbb04270f207e335761cbe88d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11290 Malicious code in ember-cli-deploy-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e75fdf3524b33e98181630b607b31f8d9f45b24cbb04270f207e335761cbe88d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...