Security advisories

medium2026-07-21

CVE-2026-59766-Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

go-gitea/gitea · GHSA-qf2f-qh6p-7v89

medium2026-07-21

CVE-2026-58440-Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

go-gitea/gitea · GHSA-66m4-5jjr-2rg5

high2026-07-21

CVE-2026-67323-GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

gitpython-developers/gitpython · GHSA-956x-8gvw-wg5v

high2026-07-21

CVE-2026-67325-GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

gitpython-developers/gitpython · GHSA-2f96-g7mh-g2hx

high2026-07-21

GitPython unsafe clone option gate bypass through joined short options

gitpython-developers/gitpython · GHSA-v396-v7q4-x2qj

high2026-07-21

CVE-2026-73650-SVGO removeScripts plugin leaves some executable scripts intact

svg/svgo · GHSA-2p49-hgcm-8545

low2026-07-21

CVE-2026-66010-DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

cure53/dompurify · GHSA-c2j3-45gr-mqc4

medium2026-07-21

jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

fasterxml/jackson-databind · GHSA-mhm7-754m-9p8w

critical2026-07-21

CVE-2026-73653-@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

vitest-dev/vitest · GHSA-p63j-vcc4-9vmv

critical2026-07-21

CVE-2026-59891-Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

sigstore/sigstore-js · GHSA-pf56-329r-95rw

medium2026-07-21

CVE-2026-59888-jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

fasterxml/jackson-databind · GHSA-3pjw-73gf-8qr5

high2026-07-21

CVE-2026-57894-Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

go-gitea/gitea · GHSA-82f7-87hm-852x

high2026-07-21

CVE-2026-59886-pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1/pyasn1 · GHSA-hm4w-wwcw-mr6r

high2026-07-21

CVE-2026-59885-pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

pyasn1/pyasn1 · GHSA-8ppf-4f7h-5ppj

high2026-07-21

CVE-2026-59884-pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

pyasn1/pyasn1 · GHSA-m4p7-r5rc-7g4j

medium2026-07-21

CVE-2026-59890-setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

pypa/setuptools · GHSA-h35f-9h28-mq5c

high2026-07-21

CVE-2026-59892-OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

open-telemetry/opentelemetry-js · GHSA-45rx-2jwx-cxfr

high2026-07-21

CVE-2026-59887-linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

markdown-it/linkify-it · GHSA-v245-v573-v5vm

high2026-07-21

CVE-2026-13760-aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

aws/aws-cdk · GHSA-vcrf-j523-4mrf

high2026-07-21

CVE-2026-13676-fast-uri vulnerable to host confusion via failed IDN canonicalization

fastify/fast-uri · GHSA-4c8g-83qw-93j6