Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers

CVE-2026-25119

## Summary When `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (de

历史摘要 · 未重新核验 · GitHub Advisory

Gogs has a Denial of Service in repository/wiki file listing web pages

CVE-2025-64719

### Summary A malicious user with rights to create a new file on a repository or wiki page can trigger a denial of servi

历史摘要 · 未重新核验 · GitHub Advisory

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

### Summary Gogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebook

历史摘要 · 未重新核验 · GitHub Advisory

SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected

CVE-2026-55866

### Impact Under concurrency, `CheckPermission` and `CheckBulkPermissions` can return `PERMISSIONSHIP_HAS_PERMISSION` f

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

CVE-2026-55776

On OpenBao 2.5.4 and 2.5.2(and likely earlier versions also), an authenticated caller with write access to `transit/keys

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

CVE-2026-55775

### Summary A user that is granted namespace management (`/sys/namespaces`) capabilities within a non-root namespace ("

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

CVE-2026-55774

### Summary OpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases

历史摘要 · 未重新核验 · GitHub Advisory

OpenBao: LDAPi ldaputil (wrong escape func)

CVE-2026-55770

## 1. Description ### Component `sdk/helper/ldaputil/client.go` — the shared LDAP utility library used by both the LDA

历史摘要 · 未重新核验 · GitHub Advisory

Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms

CVE-2026-55187

## Summary The remediation shipped in mailpit v1.29.2 for [GHSA-mpf7-p9x7-96r3](https://github.com/axllent/mailpit/secu

历史摘要 · 未重新核验 · GitHub Advisory

Open Redirect Bypass in miniflux-v2

CVE-2026-55185

### Summary The URL restrictions in `miniflux-v2` can be bypassed by attackers, leading to an open redirect vulnerabilit

历史摘要 · 未重新核验 · GitHub Advisory

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

CVE-2026-54762

## Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected

历史摘要 · 未重新核验 · GitHub Advisory

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

CVE-2026-55828

### Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractT

历史摘要 · 未重新核验 · GitHub Advisory

Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

CVE-2026-11769

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path

历史摘要 · 未重新核验 · GitHub Advisory

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enab

历史摘要 · 未重新核验 · GitHub Advisory

Blocky DNSSEC validation bypass and validation-cache scope pollution

## Summary Blocky accepts and caches forged DNS answers while `dnssec.validate: true` is enabled. The issue has two rel

历史摘要 · 未重新核验 · GitHub Advisory

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape

CVE-2026-54319

## Summary A sandbox volume reference (`volumeId`, which may also be a volume name) was forwarded to the runner and used

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

CVE-2026-55636

### Summary Capsule v0.13.2 webhook rules contain `namespace/finalize` (singular) instead of `namespaces/finalize` (plur

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Open Redirect via redirect_to

CVE-2026-25779

### Details Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possib

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

CVE-2026-28737

## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site sc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

CVE-2026-24791

## Summary Many authenticated self routes under `/api/v1/user/...` do not enforce the `public-only` token restriction.

历史摘要 · 未重新核验 · GitHub Advisory