CVE-2026-72410

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Validate NIX maximum LFs correctly NIX maximum number of LFs can be set via devlink command but that can be done before assigning any LFs to a PF/VF. The condition used to check whether any LFs are assigned is...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: timoni, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, lazygit, pgpool2exporter, scorecard, crossplane-provider-aws-cloudwatchlogs, http-echo, litestream, octo-sts, src, custom-pod-autoscaler, croc, manifest-tool, opentofu, runc,...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

CLEANSTART-2026-CS42741 Security fixes in git-lfs 3.7.0-r1

Package git-lfs version 3.7.0-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-XM62269 Security fixes in git-lfs-fips 3.7.0-r2

Package git-lfs-fips version 3.7.0-r2 fixes 11 vulnerabilities: CVE-2025-47911, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2025-61730...

CLEANSTART-2026-QB92274 Security fixes in git-lfs 3.7.0-r3

Package git-lfs version 3.7.0-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5. A patched version of the package is available...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

EUVD-2026-41606

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

Oracle Linux 10 : git-lfs (ELSA-2026-39272)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39272 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

MiracleLinux 8 : git-lfs-3.4.1-12.el8_10 (AXSA:2026-1269:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1269:09 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...