jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-59889

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by it

历史摘要 · 未重新核验 · GitHub Advisory

TypeORM: migration:generate template-literal code injection

### Summary `typeorm migration:generate` embeds database schema metadata into JS/TS template literals, escaping backtic

历史摘要 · 未重新核验 · GitHub Advisory

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

## Summary The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXM

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

CVE-2026-20779

### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

CVE-2026-56816

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's

历史摘要 · 未重新核验 · OSV.dev

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVE-2026-58429

### Summary A personal access token restricted with the public-only scope can still retrieve private organization member

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-59765

### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, w

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Webhook Authorization Header Returned in Plaintext via API

CVE-2026-58511

## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypte

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVE-2026-57897

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose acc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-only API token restriction is not enforced on team API routes

CVE-2026-58431

### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-58427

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enum

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

CVE-2026-58422

### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Notification API leaks private issue metadata after access revocation

CVE-2026-58419

# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Unauthorized Access to Labels of Private Organizations

CVE-2026-25038

## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpo

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

CVE-2026-27775

## Vulnerability Header | Field | Value

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

CVE-2026-24451

### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a par

历史摘要 · 未重新核验 · GitHub Advisory

Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows un

历史摘要 · 未重新核验 · OSV.dev

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

CVE-2026-47731

The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based

历史摘要 · 未重新核验 · OSV.dev

Netty has a Security Control Bypass via CORS Short-Circuit Failure

CVE-2026-56746

Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4

历史摘要 · 未重新核验 · OSV.dev