Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration
CVE-2026-22555
## Summary The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` only checks `IsOrgMember()` when a user forks a r
#go
共收录 737 条相关情报。
← 返回所有主题Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
CVE-2026-54324
### Summary A cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user
Gitea: Token scope bypass on web archive download endpoint
CVE-2026-20706
## Summary PR #37698 added checkDownloadTokenScope to /raw/*, /media/*, and attachment download web endpoints. The /arc
Gitea: Missing repository-unit authorization on issue-template API endpoints
CVE-2026-27783
## Summary Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_co
Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw
CVE-2026-25714
## Summary Two related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix).
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
CVE-2026-26231
## Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
CVE-2026-28699
### Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication
Gogs: Overwriting critical files results in a denial of service
CVE-2026-52797
**Vulnerability type:** Path Traversal **Impact:** DoS **Exploitation prerequisite:** authorized user **Description:** A
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
CVE-2026-49980
## Summary `rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form: ```text /[r
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer Tokens
CVE-2026-28744
### Summary Gitea v1.26.1 enforces repository-scoped access-token permissions on repository operations. In the Git Smart
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
CVE-2026-54322
### Summary Daytona's organization role update and delete endpoints authorized the caller as an owner of the organizatio
Caddy: stripHTML template function bypass
CVE-2026-52846
### Summary Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malfo
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
CVE-2026-52845
### Summary `forward_auth copy_headers` deletes the exact client-supplied identity header before copying the trusted va
Caddy: Windows `file_server` path authorization bypass via encoded backslash
CVE-2026-52844
### Summary On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` la
Daytona: Public sandbox previews remain accessible for up to one hour after being made private
CVE-2026-54321
### Summary Sandbox previews that were switched from public to private could remain reachable without authentication for
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
CVE-2026-53622
## Summary There is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthe
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection
CVE-2026-54090
> [!NOTE] > **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existe
File Browser has incorrect access control for public directory shares via rule path rebasing
CVE-2026-54091
### Summary File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and th
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
CVE-2026-54093
### Summary filebrowser builds the download-as-zip / download-as-tar archive entry names with `filepath.ToSlash`, which
File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
CVE-2026-54094
## Summary File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/us