Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-8862

IBM Netezza Software versions 11.3.0.3 through Interim Fix 002 contain hardcoded credentials in the application source code, granting unauthorized network access to the associated container registry . The exposed secret allows attackers to pull private container images , potentially revealing pro...

EUVD-2026-70745

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code,...

gitea -- multiple vulnerabilities

The Gitea team reports: CVE-2026-27783: incorrect read permission check CVE-2026-25714: public-only token filtering bypass CVE-2026-20706: missing token scope checking CVE-2026-27771: unauthenticated access to private container images CVE-2026-28744: git smart HTTP request scope bug CVE-2026-2869...

PYSEC-2026-150

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the API for documents and images. A user with access to the API can access filenames and names of items...

EUVD-2012-1606

Malware in sbrugna...

EUVD-2022-1990

Malicious code in bioql PyPI...

SUSE CVE-2015-7561

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...

SUSE CVE-2010-1190

thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as imgauth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations...

Information Exposure

Overview mediawiki/core is a Free software wiki application developed by the Wikimedia Foundation and others. Note: This package is not maintained on Packagist anymore, but newer releases exist. Affected versions of this package are vulnerable to Information Exposure via the imgauth.php process. ...

GHSA-2H9C-34V6-3QMR Kubernetes in OpenShift3 Access Control Misconfiguration

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...

Kubernetes in OpenShift3 Access Control Misconfiguration

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...

Red Hat OpenShift3 Kubernetes Sensitive Information Disclosure Vulnerability

Red Hat OpenShift3 is a Platform-as-a-Service PaaS cloud computing platform that builds, tests, deploys and runs applications. A security vulnerability in Red Hat OpenShift3 Kubernetes allows remote attackers to exploit the vulnerability by submitting a special request to access images that are...

Code injection

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...

CVE-2015-7561

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...

CVE-2015-7561

CVE-2015-7561 in Kubernetes/OpenShift3: remote authenticated users can access other users’ private images if they know the image name. The description provided notes the impact as cross-user image access, but the documents do not specify the root cause details (e.g., how image ownership is enforc...