2026

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an exp

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AI

Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CR

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 wi

An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when con

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directi

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to t

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator w

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's accoun

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pu

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quota

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints ad

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository in

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on

Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow

Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, s

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict ac

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enfo

Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A re

Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-vis

Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted acc

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped statu

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts witho

Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without ex

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pul

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggrega

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO da

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration t

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organ

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while di

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without prevent

Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returnin

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUI

When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validat

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive t

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that all

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute s