130 matches found
CVE-2026-123009
The Gitea platform is vulnerable to code disclosure via the web editor when editing files in a fork . The root cause is an improper access control flaw where the system failed to verify if a user retained read access to a base repository when copying branches into a fork. Consequently, users who ...
octosuite
Terminal-based toolkit for GitHub data analysis. $ octosuite user torvalds from pprint import pprint import octosuite user = octosuite.Username="torvalds" exists, profile = user.exists if exists: pprintprofile Installation pip install octosuite Usage TUI Interactive Launch the interactive termina...
Gitmails
Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...
Chainguard Forks caniko input validation error vulnerability
Versions of Chainguard Forks prior to Kaniko 1.25.20 contain a security vulnerability. This vulnerability arises from using unanchored regular expressions to validate ACR registries, allowing spoofed hosts containing strings such as .azurecr.io to be accepted. As a result, Microsoft Entra ID acce...
Malicious code in @ably-forks/crypto-js (npm)
--- Credit: OpenSSF source...
EUVD-2026-41619
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private...
Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...
Malicious code in sentry-filter-forks (PyPI)
Source: kam193 ed033104f960de0ad156fa893787d61423bed78d98f2b8fcf77860bf9a493900 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...
PT-2026-65345
Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...
CVE-2026-53517 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refreshtoken grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing...
CVE-2026-24451
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized...
CVE-2026-22555 Gitea organization forks can expose organization secrets without create permission
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...
CVE-2026-22555
CVE-2026-22555 affects Gitea before 1.26.0. The vulnerability arises because the API endpoint POST /api/v1/repos/{owner}/{repo}/forks does not enforce CanCreateOrgRepo for organization forks, only IsOrgMember, enabling a user in a read-only team to create an org-repo fork. The fork creator gains ...
CVE-2026-22555 Gitea organization forks can expose organization secrets without create permission
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...
PT-2026-55590
Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description Fork synchronization continues even after a parent repository is changed from public to private. This behavior allows a fork to maintain access and synchronize data from a repository that should no longer be...
zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node participates in a network where chain forks occur mainnet, testnet, or any network with multiple miners. All default configurations are affected. The corruption persists across restarts because it is...
PT-2026-55469
Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description A chain fork, whether natural or attacker-influenced, can cause stale Sapling and Orchard note-commitment subtree roots to remain in the Zebra state. In the zebra-state/src/service/non finalized...
PT-2026-55343
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node participates in a network where chain forks occur mainnet, testnet, or any network with multiple miners. All default configurations are affected. The corruption persists across restarts because it is...
EUVD-2026-40358
Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name commit.author.name carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A us...
Linux Distros Unpatched Vulnerability : CVE-2026-11625
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the...