CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, kargo, syft, grafana-alloy, grafana, apko, trufflehog, zarf, k9s, gitsign, argo-cd, grype, dagger, gitaly, rancher-fleet, snyk-cli, xeol, crossplane, kubevela, guac, trivy-operator, flux-source-controller, argo-workflows,...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the lastlogintime sort order in the explore/users page. An attacker can obtain sensitive information about users' login times by querying the user exploratio...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the propagation of token scope for access control within Gitea's package registry. An attacker can gain unauthorized access or perform actions beyond their intended permissions by exploiting improper enforceme...

GHSA-WPWJ-69CM-Q9C5 vulnerabilities

Vulnerabilities for packages: sftpgo, gitea...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, fluent-bit-plugin-loki, argo-cd, telegraf, gitea, mattermost, atlantis, kots, splunk-otel-collector, falcosidekick, authservice...