Security advisories

high2026-07-06

CVE-2026-40859-Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

apache/camel · GHSA-6qw3-4796-5984

medium2026-07-06

CVE-2026-14802- react-dev-utils openBrowser permits command injection on macOS

react/create-react-app · GHSA-g9g6-gvq9-j4vp

high2026-07-04

CVE-2026-12252-NLTK Stanford wrapper classes execute untrusted JAR files without verification

nltk/nltk · GHSA-9r6g-266r-89x4

critical2026-07-03

CVE-2026-27780-Gitea pre-receive hook scanner errors allow branch-protection bypass

go-gitea/gitea · GHSA-vhq7-fwwh-7hjf

high2026-07-03

CVE-2026-27779-Gitea forwarded-proto validation allows canonical URL spoofing

go-gitea/gitea · GHSA-v8f2-2ghq-9whv

medium2026-07-03

CVE-2026-28705-Gitea release asset dumps permit path traversal through crafted names

go-gitea/gitea · GHSA-7jvx-g65v-r899

high2026-07-03

CVE-2026-27660-Gitea draft releases and attachments are exposed without write permission

go-gitea/gitea · GHSA-x92v-f5gc-r34v

critical2026-07-03

CVE-2026-26292-Gitea LFS mirror operations bypass migration HTTP transport protections

go-gitea/gitea · GHSA-rc56-rj3f-xggf

medium2026-07-03

CVE-2026-25782-Gitea tracked-time deletion is not scoped to the requested issue

go-gitea/gitea · GHSA-qm72-8prh-g92x

critical2026-07-03

CVE-2026-26247-Gitea OAuth2 PKCE S256 verifier bypass

go-gitea/gitea · GHSA-m5ch-ppfx-xv3v

high2026-07-03

CVE-2026-26307-Gitea git grep searches allow server resource exhaustion

go-gitea/gitea · GHSA-h9c5-x7g8-4q7f

critical2026-07-03

CVE-2026-25718-Gitea template repository generation follows unsafe filesystem paths

go-gitea/gitea · GHSA-h697-89cp-24q8

medium2026-07-03

CVE-2026-20909- Gitea exposes tracked time entries without repository authorization

go-gitea/gitea · GHSA-fhq3-p242-2qpf

critical2026-07-03

CVE-2026-22547-Gitea repository creation accepts insufficiently validated fields

go-gitea/gitea · GHSA-922f-hfwp-p56f

critical2026-07-03

CVE-2026-26232-Gitea OAuth2 authorization codes can be reused after expiry

go-gitea/gitea · GHSA-5v69-g2m3-3hq3

high2026-07-03

CVE-2026-27657-Gitea primary email ownership bypass allows cross-user email changes

go-gitea/gitea · GHSA-4c8f-3m6h-m56r

high2026-07-03

CVE-2026-24690-Gitea pull request branch permission checks allow unauthorized updates and rebases

go-gitea/gitea · GHSA-47rq-xp99-92mx

high2026-07-03

CVE-2026-25712-Gitea organization permission APIs expose hidden membership and private organization data

go-gitea/gitea · GHSA-37w2-86g3-h4qh

high2026-07-03

CVE-2026-12481-Keras: Lambda deserialization can bypass safe mode and execute code

keras-team/keras · GHSA-5gwj-m78q-7pq3

high2026-07-02

CVE-2026-49360-Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

datarecce/recce · GHSA-rh62-j648-g5qc