CVE-2026-59766

The Git repository management system Gitea is vulnerable to an access control deficiency in its starred-repository and tracked-time API endpoints. Specifically, the getStarredRepos() function in routers/api/v1/user/star.go and the ListMyTrackedTimes() function in routers/api/v1/repo/issue_tracked...

CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

CVE-2026-59766 Gitea private repository metadata disclosure after access revocation

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user. A user whose access to a private repository has been revoked can still retrieve repository metadata through /api/v1/user/starred and...

ROOT-OS-UBUNTU-2404-CVE-2026-52934 CVE-2026-52934 in linux - Patched by Root

Root has patched CVE-2026-52934 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

Medium: libreoffice

Issue Overview: LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a...

GO-2026-6343 Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea

Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea...

PYSEC-2026-3982

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

DEBIAN-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817

GitPython before 3.1.60 is vulnerable to remote code execution via git directory impersonation . The library fails to properly validate the git directory location, allowing an attacker to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. The attack executes ar...

CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

PT-2026-88955

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.60 Description GitPython fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can execut...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160

CVE-2026-48160 (react-tracked) describes malicious commits on the default branch that, during npm install, could execute attacker-controlled code on developer machines. The window between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 included commits 6978272a7d6ca02225cb747ea69f427512e33699 through...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

EUVD-2026-55836

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...