Advisory Catalog

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

rclone: Incomplete path validation allows backend root escape in serve restic

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

netfoil: Incorrect block responses could lead to localhost traffic

ZITADEL Users Can Self-Verify Email/Phone via API

openhole-server vulnerable to path traversal via URL-decoded request path

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

etcd: Watch API authorization bypass via open-ended range requests

Oh My Posh: Arbitrary command execution via template injection in the path segment

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: Notification API leaks private issue metadata after access revocation

Gitea: Unauthorized Access to Labels of Private Organizations

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Gitea: Two SSRF findings

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

File Browser: Colliding username normalization gives two users the same home directory

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Gitea has insufficient permission checks for Composer package source links