PT-2026-117151

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSH TRUSTED USER CA KEYS and accepts arbitrary principals SSH AUTHORIZED PRINCIPALS ALLOW=anything, a user could...

CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111887

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933

The Coder software versions prior to 2.34.2 (specifically before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2) are vulnerable to a user enumeration flaw. The root cause is that the userpassword.Compare() function substitutes a placeholder hash derived from the str...

EUVD-2026-103300

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

EUVD-2026-103293

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111887 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111887 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111887 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

EUVD-2026-103332

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111887

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with...

CVE-2026-111887

The phpMyFAQ application is vulnerable to account enumeration in versions prior to 4.1.9 and 4.2.0-alpha before 4.2.0-beta . An unauthenticated attacker can submit guest comments to the comment creation endpoint, using candidate usernames and emails to confirm registered account details. The syst...

Gitea security vulnerabilities

Gitea versions 28.1.0 and earlier have security vulnerabilities. These vulnerabilities stem from the fact that when parsing SSH certificates, the system searches for all stored public keys rather than just the main key. If a user trusts the certificate authority and accepts any main key, it may...

Gitea’s improper exception handling vulnerabilities

Gitea 28.1.0 and earlier versions have a vulnerability related to improper exception handling. This vulnerability arises when the organization’s handler processes requests from individual users with the format username/-/repositories. In such cases, the handler may dereference an empty...