2026

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-se

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming()

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0,

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request t

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registra

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSoc

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticat

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allow

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitra

The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TR

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenti

The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows r

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attack

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exp

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic in

Webhook Authorization Header Returned in Plaintext via API

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on pu

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Private Repository Existence Disclosure via go-get Meta Endpoint

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep

Public-only repository tokens can update private PR head branches

Repository migration SSRF via multi-answer DNS allow-list bypass

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of pr

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot

Repository Visibility Manipulation via Git Push Options

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea LFS Deploy-Key Privilege Escalation

Private Repository Metadata Remains Accessible After Access Revocation

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti

Public-only API token restriction is not enforced on team API routes

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Local File Inclusion via file:// URI in Migration Restore