Advisory Catalog

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

etcd: Watch API authorization bypass via open-ended range requests

Oh My Posh: Arbitrary command execution via template injection in the path segment

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: Webhook Authorization Header Returned in Plaintext via API

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Gitea: Public-only API token restriction is not enforced on team API routes

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: Notification API leaks private issue metadata after access revocation

Gitea: Unauthorized Access to Labels of Private Organizations

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Gitea: Two SSRF findings

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea SSH Key Parser Denial of Service

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea LFS Deploy-Key Privilege Escalation

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: REST API exposes organization membership of private organizations to public

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint