Browse CVEs by Ecosystem and Severity

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Gitea has insufficient permission checks for Composer package source links

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

kumactl connects to control plane without verifying TLS certificate when no CA is configured

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

melange: Incomplete package integrity verification allows data section substitution

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

File Browser: Authentication Bypass via Proxy Auth Header Forgery

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

Gitea pre-receive hook scanner errors allow branch-protection bypass

Gitea OAuth2 authorization codes can be reused after expiry

Gitea repository creation accepts insufficiently validated fields

Gitea template repository generation follows unsafe filesystem paths

Gitea OAuth2 PKCE S256 verifier bypass

Gitea LFS mirror operations bypass migration HTTP transport protections

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Rancher has Privilege Escalation from Project Owner to Host

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Rancher vulnerable to command injection through unsanitized YAML parameter

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation

Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape

Fission Container Executor Function PodSpec Injection Leading to Node Escape