Advisory Catalog

Gitea tracked-time deletion is not scoped to the requested issue

Gitea OAuth2 authorization codes can be reused after expiry

Gitea OAuth2 PKCE S256 verifier bypass

Gitea LFS mirror operations bypass migration HTTP transport protections

Gitea git grep searches allow server resource exhaustion

Gitea primary email ownership bypass allows cross-user email changes

Gitea draft releases and attachments are exposed without write permission

Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

SFTPGo has stored XSS via inline parameter on public shares and user file download

SFTPGo has path confinement bypass in public browsable share partial ZIP download

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

goshs: Share-link ?token=… redemption races past download limit

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

ORAS Go forwards registry credentials across registry redirects

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

oras-go has file store write outside workingDir via symlink traversal

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Rancher has Privilege Escalation from Project Owner to Host

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Rancher vulnerable to command injection through unsanitized YAML parameter

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Concourse login flow has an open redirect issue

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Probo has an open redirect bypass via path normalization

Nightingale exposes datasource credentials to low-privilege users

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission Container Executor Function PodSpec Injection Leading to Node Escape

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook

Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec

Kahi has privilege-drop and socket/log permission issues