漏洞公告

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah: SVG `href` attribute bypasses local-reference restriction

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

TypeORM: migration:generate template-literal code injection

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Gitea: Webhook Authorization Header Returned in Plaintext via API

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Gitea: Public-only API token restriction is not enforced on team API routes

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: Notification API leaks private issue metadata after access revocation

Gitea: Unauthorized Access to Labels of Private Organizations

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Gitea: Two SSRF findings