63 matches found
BIT-KIBANA-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...
BIT-KIBANA-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the...
BIT-KIBANA-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
BIT-KYVERNO-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature
Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...
BIT-KYVERNO-2023-54356 Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites TLSECDHERSAWITH3DESEDECBCSHA and TLSRSAWITH3DESEDECBCSHA on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack CVE-2016-2183, which, over very long-lived TLS connections carrying large volumes...
BIT-JUPYTERLAB-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
BIT-GITEA-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...
BIT-GITEA-2026-96594 Gitea repository media API stored XSS
The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...
BIT-GITEA-2026-96589 Gitea private repository access retained after rejected transfer
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to...
BIT-GITEA-2026-96580 Gitea Actions memory exhaustion through large static matrices
Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...
BIT-GITEA-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
BIT-GITEA-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...
BIT-GITEA-2026-96399 Gitea denial of service through external issue tracker patterns
A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings...
BIT-GITEA-2026-95112 Gitea issue reference parsing CPU exhaustion
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...
BIT-GITEA-2026-95106 Gitea review and execution mismatch through duplicate tree entries
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...
BIT-GITEA-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pullrequest activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval,...
BIT-GITEA-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts
Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...
BIT-GITEA-2026-89182 Gitea push-to-create bypass of FORCE_PRIVATE policy
With repository FORCEPRIVATE = true, Gitea creates new repositories as private, but the post-receive hook still applied the repo.private=false push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instan...
BIT-GITEA-2026-86684 Gitea push mirror local path check uses the repository owner
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...
BIT-GITEA-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
BIT-GITEA-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in
Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...
BIT-GITEA-2026-70357 Gitea repository migration SSRF through DNS rebinding
Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between...
BIT-GITEA-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...
BIT-GITEA-2026-105268 Gitea issue attachment API allows changing comment attachments
The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...
BIT-GITEA-2026-105267 Gitea tag delete route deletes releases without release permission
The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...
BIT-GITEA-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches
Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects...
BIT-GITEA-2026-104633 Gitea migration memory exhaustion from zero page size
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...
BIT-GITEA-2026-104632 Gitea fork workflow approval bypass through cancel and rerun
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...
BIT-GITEA-2026-104626 Gitea fork workflow job revival through later approval
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...
BIT-GITEA-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens
Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...
BIT-ELK-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure
Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...
BIT-ELK-2026-102410 Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an equivalent, related API in the...
BIT-ELK-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...
BIT-ELASTICSEARCH-2026-102409 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion CWE-674 in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation CAPEC-130...
BIT-ELASTICSEARCH-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...
BIT-ELASTICSEARCH-2026-102407 Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...
BIT-ELASTICSEARCH-2026-102404 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memor...
BIT-GHOST-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...
BIT-GHOST-2026-105682 Ghost: Server-Side Request Forgery in Webhook Trigger
Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0...
BIT-GHOST-2026-105681 Ghost: Authorization Bypass in Comments Feature
Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...
BIT-GHOST-2026-105680 Ghost: Authorization Issue Allowed Author Role to Delete any Post
Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0...
BIT-GHOST-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage
Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...
BIT-GHOST-2026-105678 Ghost: Editors Could Promote Staff Users to Their Own Role
Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...
BIT-GHOST-2026-105677 Ghost: Remote Code Execution via Theme Translation Files
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...
BIT-GHOST-2026-105676 Ghost: Path Traversal via Locale Setting
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...
BIT-GHOST-2026-105675 Ghost: Invite Token Disclosure in Ghost Admin API
Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...
BIT-GHOST-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API
Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...
BIT-GHOST-2026-105651 Ghost: Stored XSS via Bookmark Card Images
Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...
BIT-GHOST-2026-105650 Ghost: Stored XSS via oEmbed Photo Responses
Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulti...
BIT-GHOST-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...