deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

xz-utils-backdoor-case-study

XZ Utils 백도어 기술 사례 연구 — 유지관리자 신뢰가 어떻게 공급망 실행 경로가 되었는가 유지관리자에 대한 신뢰가 공격 경로가 된 순간. 개요 CASE-002 는 2024년 3월 29일에 공개된 XZ Utils / liblzma 백도어를 CVE-2024-3094 로 재구성한다. 이 보고서는 장기간 유지관리자 신뢰와 릴리스 권한에서 시작하여, 검토된 Git 소스와 배포된 릴리스 tarball 간의 불일치, 빌드 시점의 페이로드 추출, liblzma 수정, sshd로 이어지는 전이적 의존성 경로, GNU IFUNC / 동적...

CVE-2024-3094

Bonsoir, Je tiens à vous informer d'un problème de sécurité critique qui a été identifié et qui affecte directement la communauté Linux, y compris les serveurs et les appareils Android. Il a été découvert que l'un des contributeurs, connu sous le nom de Jesse, distribuait des binaires corrompus...

Review.CVE-2023-5612

CVE-2023-5612 – SSRF в GitLab через URL вебхуков PoC и анализ 📌 Обзор CVE CVE-ID: CVE-2023-5612 Серьёзность: Высокая базовая оценка CVSS: 8.1 Тип: Server-Side Request Forgery SSRF Компонент: Вебхуки GitLab CE/EE Затронутые версии: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888" ...

EUVD-2026-80249

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

PT-2026-93361

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Owner or Maintainer permissions can silently disable protected...

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

PT-2026-89744

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Restricted API tokens can be used to gain unauthorized access to the "allow maintainer edit" feature. Recommendations Update to version 16.0.4 or later...

CVE-2026-89151: Incorrect Authorization

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

PT-2026-87021

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-122)

Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read...

BIT-GITLAB-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...