Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-58424Permanent Fork PR Workflow Approval Gate BypassGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accountsGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58419Notification API leaks private issue metadata after access revocationGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-58418SSRF via HTTP Redirect in Repository MigrationGo · code.gitea.io/gitea · fixed in 1.26.4
- CVE-2026-12481Deserialization of Untrusted Data in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokensGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorizationGo · code.gitea.io/gitea, gitea.dev · fixed in 1.26.3
- CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequiredGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-28705Gitea repository dumps write release assets using unsafe path namesGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopesGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27783Gitea issue-template APIs bypass repository unit authorizationGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27780Gitea pre-receive hook can miss branch-protection checks after scanner errorsGo · code.gitea.io/gitea · fixed in 1.26.0
- CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofingGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-27775Gitea pre-receive hook permission cache allows full repository write accessGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-27771Gitea Composer package source links use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-27761Gitea repository feeds bypass API token scope enforcementGo · code.gitea.io/gitea · fixed in 1.26.3
- CVE-2026-27660Gitea draft releases use insufficient permission checksGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-27657Gitea email settings allow changing another user's primary email addressGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26307Gitea git grep search lacks a timeoutGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26292Gitea LFS mirror synchronization bypasses migration HTTP transport restrictionsGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26247Gitea OAuth2 PKCE S256 challenges are not enforced during token exchangeGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26232Gitea OAuth2 authorization codes lack expiry and reuse enforcementGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-26231Gitea maintainer-edit permissions allow unauthorized commits to readable repositoriesGo · code.gitea.io/gitea · fixed in 1.26.2
- CVE-2026-25782Gitea tracked-time deletion can target entries from another issueGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25779Gitea redirect handling permits open redirects through backslash pathsGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.26.0
- CVE-2026-25718Gitea template repository generation mishandles symlinked pathsGo · code.gitea.io/gitea · fixed in 1.25.5
- CVE-2026-25714Gitea user organization API bypasses public-only token filteringGo · code.gitea.io/gitea · fixed in 1.26.2