FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-71184): Gitea -- multiple vulnerabilities

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork hea...

PT-2026-114276

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When a trusted base-branch workflow runs for a pull request target event, the system resolves local reusable workflow files from the head commit of a fork. This allows a fork author to modify a...

CVE-2026-55675

The Salty documentation repository contains a vulnerability where a fork pull request can execute arbitrary code in a privileged base-repository workflow. Specifically, the .github/workflows/trigger-pr-build.yml file records an untrusted fork commit in an artifact, which the .github/workflows/bui...

CVE-2026-66877

Workflow runs from first-time fork contributors are held for maintainer approval only by inserting the run's jobs in a blocked state. The component that transitions blocked jobs to waiting does not re-check whether the run still needs approval. A separate, legitimate run in the same repository th...

clusterfuzzlite

ClusterFuzzLite ClusterFuzzLite es una solución continua de fuzzing que se ejecuta como parte de flujos de trabajo de Integración Continua CI para encontrar vulnerabilidades más rápido que nunca. Con solo unas pocas líneas de código, los usuarios de GitHub pueden integrar ClusterFuzzLite en su...

GHSA-G8RX-F7M5-7794 Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Impact An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect filesystem paths outside the expected working area. Depending on the backend deployment, this could compromise backend confidentiality, integrity, or availability. Patches ...

CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-96580

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-94205

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...

CVE-2026-104632

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104626

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-96580

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-96580

Gitea expanded a workflow's static "strategy.matrix" into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

EUVD-2026-93924

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...

CVE-2026-96580

The Gitea Actions service is vulnerable to memory exhaustion because it expands a workflow's static strategy.matrix into a full Cartesian product without a size limit during run creation. This occurs before the fork pull request approval gate is applied, allowing a user with permission to open a ...