opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

Vulnerabilities (1,719)

• CVE-2026-58428medJul 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAtta

• CVE-2026-56443medJul 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary After [PR #37118](https://github.com/go-gitea/gitea/pull/37118) / **CVE-2026-25714** (`fix: Unify public-only token filtering in API queries and repo access checks`, merged 2026-05-18, backport `#37773` to 1.26.2 — the May 2026 unification pass for public-only token f

• CVE-2026-58440medJul 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Affected product Gitea — `services/repository/collaboration.go` (`DeleteCollaboration`) + webhook delivery ## Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's r

• CVE-2026-57894higJul 21, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  # Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration ## Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the G

• CVE-2026-62684lowJul 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt `password_hash` and the secret `token` of the share. The `Link` storage struct is serialized directly with `json.Marshal` and tags `password_hash` and `

• CVE-2026-48824Jul 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes") wrapped only `POST /api/v1/send` with `ht

• CVE-2026-49834Jul 19, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a sing

• CVE-2026-54246medJul 17, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Description The `routesrv` component exposes the full cluster route topology (Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths) and cache-cluster topology (Redis/Valkey shard addresses) over plain HTTP with **zero authentication**. Any

• CVE-2026-50197Jul 17, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, be

• CVE-2026-54247medJul 17, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary The Kubernetes admission webhook handler reads the entire request body using `io.ReadAll(r.Body)` without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OO

• CVE-2026-52724medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection ## Impact An on-path attacker can inter

• CVE-2026-52832medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary Nuclio Dashboard exposes `POST /api/functions` without authentication by default (NOP auth mode). The `spec.handler` field (e.g., `mymodule:myfunction`) is parsed by `functionconfig.ParseHandler()` which splits on `:` only — no path validation is applied to the module

• CVE-2026-52833higJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ## Summary Nuclio's Java runtime generates a `build.gradle` file during function builds using Go's `text/template` package. The template renders `runtimeAttributes.repositories[]` values with the `{{ . }}` action, which performs no escaping. An attacker can embed a closing brace

• CVE-2026-49998Jul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer because the JWKS cache and singleflight lookup were keyed only by JW

• CVE-2026-53714higJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ### Impact When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a `StreamInterceptor` for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and

• CVE-2026-53713criJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ### Impact The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is equivalent to `/etc/passwd` (POSIX path semantics), but `is_critical_path` fails to match the double-slash variant because

• CVE-2026-53715medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Pod-network reachability to :18002 (no auth) - Tenant can create EnvoyExtensionPolicy (baseline) - Attacker pod floods GET while churning EnvoyExtensionPoli

• CVE-2026-53717medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create EnvoyExtensionPolicy (baseline) - Controller has egress to attacker-controlled OCI registry - No registry allowlist (none exists in code)

• CVE-2026-53719medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant has SecurityPolicy + TCPRoute RBAC (baseline) - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted (the

• CVE-2026-53716medJul 16, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):** - Tenant can create EnvoyExtensionPolicy (baseline) - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset (optional field; check is post-decompressio