etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

GHSA-6vch-q96h-7gc3 HIGH 3 days ago

### Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener can open many TCP connection...

go

No PRs yet

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

GHSA-jpcw-4wr7-c3vq MODERATE 3 days ago

| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `<= 0.143.0` (introduced in `v0....

go

No PRs yet

etcd: Watch API authorization bypass via open-ended range requests

GHSA-xg4h-6gfc-h4m8 HIGH 3 days ago

### Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key can use the Watch gRPC API w...

go

No PRs yet

Oh My Posh: Arbitrary command execution via template injection in the path segment

GHSA-6xj8-qv9j-xcjq HIGH 3 days ago

### Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/tem...

go

No PRs yet

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

GHSA-fwjx-9p69-h25h MODERATE 3 days ago

### Summary Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment varia...

go

No PRs yet

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

GHSA-86cx-wwf4-phq4 MODERATE 3 days ago

### Summary An authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path val...

go

No PRs yet

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

GHSA-p6ph-3jx2-3337 MODERATE 3 days ago

### Summary An authorization bypass and information disclosure vulnerability exists in the search API of `Openlist`. Due to a non-separator-aware p...

go

No PRs yet

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

GHSA-95cv-r8x4-vh75 HIGH 3 days ago

### Summary The `/api/fs/batch_rename` handler validates and authorizes only the requested source directory. It rejects path separators in `new_na...

go

No PRs yet

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

GHSA-v6w6-358x-2433 MODERATE 3 days ago

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept attacker-controlled node def...

go

No PRs yet

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

GHSA-26gq-p25f-99cp HIGH 3 days ago

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the en...

go

No PRs yet

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

GHSA-c534-2w9c-x7fm MODERATE 3 days ago

## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route para...

go

No PRs yet

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

GHSA-c3jm-gv5r-9wcp CVE-2026-62323 MODERATE 3 days ago

## Summary Cloudreve WOPI access tokens are generated as `<session-id>.<random-secret>`, but the WOPI middleware validates only the session id pre...

go

No PRs yet

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

GHSA-g35j-m5xg-vh3q CVE-2026-57497 MODERATE 3 days ago

## Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. T...

go

No PRs yet

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

GHSA-hq88-5x99-x3gf CVE-2026-55502 HIGH 3 days ago

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to `Admin.Rea...

go

No PRs yet

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

GHSA-w8x7-h2px-xmq8 CVE-2026-55499 MODERATE 3 days ago

## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/events?uri=<share-root>`), C...

go

No PRs yet

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

GHSA-g9j2-8w95-3vwv CVE-2026-55497 MODERATE 3 days ago

## Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`image/png`, `image/jpeg`, `imag...

go

No PRs yet

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

GHSA-8r7f-r8hj-r3rv CVE-2026-55496 MODERATE 3 days ago

## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`, but despite its name that m...

go

No PRs yet

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

GHSA-49h3-cwhj-4737 CVE-2026-55495 MODERATE 3 days ago

## Summary Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It splits the header on `/` and joi...

go

No PRs yet

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

GHSA-r277-6w6q-xmqw CRITICAL 3 days ago

### Summary `ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which al...

go

No PRs yet

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

GHSA-gcjh-h69q-9w9g MODERATE 3 days ago

The function `ext.NativeTypes(ParseStructTag("json"))` does not honour the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"` are ...

go

No PRs yet

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

GHSA-464c-974j-9xm6 LOW 3 days ago

## Summary The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and ...

go maven npm +2 more

No PRs yet

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

GHSA-hrxh-6v49-42gf HIGH 6 days ago

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and...

go

No PRs yet

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

GHSA-gx3v-q759-g323 CVE-2026-20779 HIGH 6 days ago

### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2018 fix (PR #3878) introduc...

go

No PRs yet

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

GHSA-fq2p-5p22-8g6j CVE-2026-58429 MODERATE 6 days ago

### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permi...

go

No PRs yet

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

GHSA-2wm4-vwp6-v7xc CVE-2026-59765 MODERATE 6 days ago

### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs...

go

No PRs yet

Gitea: Webhook Authorization Header Returned in Plaintext via API

GHSA-3r5c-2xxx-h872 CVE-2026-58511 LOW 6 days ago

## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypted` field and returns the pl...

go

No PRs yet

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

GHSA-frpw-3h2q-4jj6 CVE-2026-57897 MODERATE 6 days ago

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @ `b7e95cc48c` (development b...

go

No PRs yet

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-q423-49rw-g9mh CVE-2026-58510 MODERATE 6 days ago

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose access has been revoked", fix ...

go

No PRs yet

Gitea: Public-only API token restriction is not enforced on team API routes

GHSA-h56g-4qw7-2mxg CVE-2026-58431 MODERATE 6 days ago

### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction. A `public-only` token is...

go

No PRs yet

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

GHSA-prr9-9mp4-5gp2 CVE-2026-58427 MODERATE 6 days ago

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not jus...

go

No PRs yet

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

GHSA-g9g6-qhrc-p3qc CVE-2026-58422 HIGH 6 days ago

### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates thro...

go

No PRs yet

Gitea: Notification API leaks private issue metadata after access revocation

GHSA-44qc-pgvp-wx7v CVE-2026-58419 HIGH 6 days ago

# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue acce...

go

No PRs yet

Gitea: Unauthorized Access to Labels of Private Organizations

GHSA-v73x-hx65-6pf4 CVE-2026-25038 HIGH 6 days ago

## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpoints. A user without acces...

go

No PRs yet

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

GHSA-649p-mmhf-85c7 CVE-2026-27775 HIGH 6 days ago

## Vulnerability Header | Field | Value | | ----------...

go

No PRs yet

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

GHSA-wrf9-r3h7-7x5v CVE-2026-24451 HIGH 6 days ago

### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a parent repository after the pa...

go

No PRs yet

Gitea: Two SSRF findings

GHSA-2fcr-jfvc-vgg2 CVE-2026-58314 HIGH 6 days ago

| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/g...

go

No PRs yet

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

GHSA-fw57-jgch-pgf3 CVE-2026-58436 HIGH 6 days ago

### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language.ParseAcceptLanguage` on th...

go

No PRs yet

Gitea SSH Key Parser Denial of Service

GHSA-4xjf-493q-98p3 CVE-2026-56657 MODERATE 6 days ago

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains a...

go

No PRs yet

Gitea: Repository Visibility Manipulation via Git Push Options

GHSA-8p9h-49rc-qgxj CVE-2026-58437 HIGH 6 days ago

### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `routers/private/hook_post_r...

go

No PRs yet

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

GHSA-vrhc-jjfc-m3m3 CVE-2026-55987 HIGH 6 days ago

## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user signs in through an authent...

go

No PRs yet

Gitea LFS Deploy-Key Privilege Escalation

GHSA-rh79-75qm-gwjr CVE-2026-58435 MODERATE 6 days ago

## Vulnerability Header | Field | Value | | ------------------- | ------------...

go

No PRs yet

Gitea: Local File Inclusion via file:// URI in Migration Restore

GHSA-5ggr-2f2h-jmvm CVE-2026-58420 MODERATE 6 days ago

# Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/u...

go

No PRs yet

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

GHSA-m932-crvm-gcp5 CVE-2026-55984 LOW 6 days ago

### Summary The AddTime API handler continues execution after an error returned by `GetUserByName()`. When a repository administrator specifies a...

go

No PRs yet

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

GHSA-mg4f-x9v4-6h2p CVE-2026-55982 MODERATE 6 days ago

### Summary The OIDC userinfo endpoint (`GET /login/oauth/userinfo`) accepts Gitea API tokens as bearer credentials but does not enforce API token...

go

No PRs yet

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

GHSA-j2w3-9c3r-g83q CVE-2026-58434 LOW 6 days ago

### Summary A user who previously had access to a private repository can continue to obtain repository metadata through `GET /api/v1/user/starred`...

go

No PRs yet

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

GHSA-94v3-77j7-vm48 CVE-2026-54481 HIGH 6 days ago

Summary Gitea's internal API HTTP client (modules/private/internal.go) hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration o...

go

No PRs yet

Gitea: REST API exposes organization membership of private organizations to public

GHSA-jr5x-6h83-wrxf CVE-2026-58417 MODERATE 6 days ago

### Summary The endpoint "/orgs/{org}/public_members/{username}" + GET exposes organization membership of public members in a private organizatio...

go

No PRs yet

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

GHSA-6cqf-375w-639g CVE-2026-50105 MODERATE 6 days ago

### Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform **no token-scope or public-only enforcement**. A personal acces...

go

No PRs yet

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

GHSA-fj8v-hjwv-qm88 CVE-2026-58416 MODERATE 6 days ago

### Summary `GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target rep...

go

No PRs yet

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

GHSA-wwqq-x6w4-frm2 CVE-2026-42931 MODERATE 6 days ago

### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea serve...

go

No PRs yet