CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services...

CVE-2026-78231

The Gitea platform is vulnerable to a blind Server-Side Request Forgery (SSRF) via its OpenID sign-in verification flow. When OpenID sign-in is enabled, the application processes unauthenticated GET requests to "/user/login/openid" and passes attacker-controlled assertion parameters into the Open...

CVE-2026-73804

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-73804 Gitea API token scope escalation through HTTP signatures

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-73804

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-73804

Gitea is vulnerable to API token scope escalation via HTTP signatures due to a flaw in how request scopes are validated. An attacker with a token possessing only the write:user scope can use that token to register an attacker-controlled SSH public key on the token owner's account via the POST /ap...

CVE-2026-73804 Gitea API token scope escalation through HTTP signatures

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-60021

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

CVE-2026-60021

The Gitea GitLab migration downloader is vulnerable to a Denial of Service (DoS) attack because it uses an HTTP client for version probes without a timeout and fails to attach the migration task's cancellation context . An authenticated user capable of starting migrations can trigger a request to...

CVE-2026-60021 Gitea GitLab migration denial of service

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request...

Exploit for CVE-2026-92392

CVE-2026-92392 curl/libcurl Exposure Checker A defensive chec...

CVE-2026-110618 SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

K000162613: NGINX ngx_http_v3_module vulnerability CVE-2026-95101

Security Advisory Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. CVE-2026-95101 Impact This vulnerability may...

CVE-2021-41773

Apache HTTP Server 2.4.49 - Path Traversal & RCE CVE-2021-41773 A sophisticated Python-based proof-of-concept PoC exploit for CVE-2021-41773. This tool automates the process of testing Apache 2.4.49 servers for path traversal and remote code execution RCE vulnerabilities. ⚠️ Legal Disclaimer This...

CVE-2026-86414

A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status...

ble_proxy

BLE HTTP Proxy System A Bluetooth Low Energy BLE based HTTP proxy system that routes web browser traffic through an iOS device. This allows web browsing through the iOS device's internet connection using BLE as the transport layer. Architecture Overview Browser → Windows Proxy → BLE/TCP → iOS/Moc...

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact...

RUSTSEC-2026-0350 Guests can send absolute-form HTTP requests to different hosts

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory...

RUSTSEC-2026-0351 `wasi-http`: Request with long url before query parameter crashes host

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory...