Advisory Catalog

free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure

Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

goshs has ACL Bypass & Path Traversal

goshs has a Path Traversal issue

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS

GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Gitea: Public-only API token restriction is not enforced on team API routes

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Gitea SSH Key Parser Denial of Service

Gitea LFS Deploy-Key Privilege Escalation

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea: REST API exposes organization membership of private organizations to public

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Gitea: SSRF via HTTP Redirect in Repository Migration

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)