Advisory Catalog

Gitea exposes tracked time entries without repository authorization

Gitea tracked-time deletion is not scoped to the requested issue

SFTPGo has path confinement bypass in public browsable share partial ZIP download

Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

goshs: Share-link ?token=… redemption races past download limit

ORAS Go forwards registry credentials across registry redirects

oras-go has file store write outside workingDir via symlink traversal

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Probo has an open redirect bypass via path normalization

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

fzf vulnerable to denial of service through quadratic HTTP request-body accumulation

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

regclient may leak authentication credentials to external blob stores

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Apptainer has incorrect path matching for 'limit container paths' directive

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API

Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

Gogs has DOM-based XSS via Milestone Name on New Issue Page

Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

Gogs has an Open Redirect via redirect_to

OpenShift Cluster Logging Operator missing authorization flaw

nebula-mesh's stores enrollment tokens unhashed in SQLite

package pkcs12: Authentication bypass in Decode functions

Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

Gogs has a Denial of Service in repository/wiki file listing web pages

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler

Mattermost doesn't validate channel ownership of an existing subscription before applying edits