CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874

The Gitea repository management system is vulnerable to a bypass of required actions checks during pull request events. The root cause is that Gitea reads workflow definitions from the pull request head and automatically posts a synthetic skipped status if branch or path filters exclude execution...

EUVD-2026-101088

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

CVE-2026-63792

In Gitea , the CanReadWorkflowCrossRepo function fails to exclude fork pull request runs when validating cross-repository reusable workflows. Due to the collaborative-owner trust relationship, an approved fork workflow targeting a private repository can read private workflow files from another re...

CVE-2026-63792

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

EUVD-2026-101256

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

EUVD-2026-101238

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652

ONLYOFFICE DocumentServer before version 10.0.0 is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /downloadfile/:docid endpoint. The vulnerability occurs when JWT verification is disabled in the default configuration, allowing attackers to exploit the isInJwtToken flag...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

EUVD-2026-101034

ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

CVE-2026-88829 Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...