CVE-2026-115509 Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API

Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In md/raid10, the issue of null-ptr-deref in raid10syncrequest has been fixed. In initresync, the mempool is initialized, and conf-havereplacemnt is set to 0 at the beginning of the sync process. closesync frees the mempool when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciProbe In the last error path of rtlpciProbe, the cleanup functions are skipped due to an incorrect goto label. Additionally, the successful calls to rtlInitRFKill, ieee80211RegisterHw,...

CVE-2026-66874

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

EUVD-2026-101088

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874 Gitea required Actions check bypass through skipped workflows

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

PT-2026-114245

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-66874): Gitea -- multiple vulnerabilities

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874: Improper Access Control

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66874

Gitea writes a synthetic "skipped" commit status for a workflow that matched an event but was excluded by its own "branches:" or "paths:" filter, so that a required status check tied to that workflow does not block indefinitely. For a "pullrequest" event the workflow definition is read from the...

PT-2026-109169

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no...

Allocation of Resources Without Limits or Throttling

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of skipped fields in incoming messages due to a failure to enforce recursion limits. An attacker can cause stack...

CVE-2026-92121

The Apache WSS4J library contains a vulnerability in its streaming (StAX) code . A signature reference utilizing the WS-Security STR-Transform causes an internal "inside signed content" flag to remain permanently set. This leads the WS-SecurityPolicy enforcer to stop evaluating SignedParts and Si...

CVE-2026-94417 CRL check skipped when OCSP enabled and certificate has no OCSP URL

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...

CVE-2026-94417 CRL check skipped when OCSP enabled and certificate has no OCSP URL

When an application enables both OCSP and CRL revocation checking on one WOLFSSLCTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL lists as revoked. The soft-fail policy f...

CVE-2026-94417

The wolfSSL library (all versions from 5.9.2 and earlier ) is vulnerable to a certificate revocation bypass when both OCSP and CRL checking are enabled. The flaw exists in ProcessPeerCerts() , where a soft-fail policy for missing OCSP responders causes the system to skip CRL checks for peer certi...