GitHub Security Advisory
Gitea 28.3.0 Fixes Token Scope, OAuth2, and Actions VulnerabilitiesNew!!
Gitea 28.3.0 fixes token, OAuth2, and Actions flaws. Match instance scope, upgrade, validate private-access boundaries, and retain evidence.
nvm 0.40.6 Fixes Version-String Command Injection
nvm 0.40.6 fixes version-string command injection, including auto-switch hook exposure. Update developer systems, inspect hooks, and retain evidence.
Gitea 28.2.0 Addresses 12 Security Vulnerabilities
Gitea 28.2.0 addresses 12 security flaws. Inventory instances, match advisory scope, upgrade supported streams, validate, and retain evidence.
OneUptime 14.0.69 Fixes Kubernetes AI Authorization Bypass
OneUptime 14.0.69 fixes Kubernetes AI authorization gaps. Inventory scoped users, upgrade, validate resource controls, and retain evidence.
hex_core 0.20.0 Restores TLS Certificate Validation
hex_core 0.20.0 fixes TLS certificate validation on older Erlang/OTP paths. Confirm adapter and CA-store scope, update or mitigate, and retain evidence.
ash_typescript 0.19.1 Redacts Internal RPC Error Details
ash_typescript 0.19.1 redacts internal terms from RPC errors. Confirm exposed actions, update affected applications, test errors, and retain evidence.
Decimal 3.1.2 Fixes Unbounded Rounding Allocation
Decimal 3.1.2 fixes an unbounded rounding allocation flaw. Find user-controlled places values, upgrade, validate behavior, and retain evidence.
containerd Updates Bound OCI Image Graph Processing
A crafted OCI image index can exhaust containerd resources during image pull, before a container starts. Update affected runtimes through the host or cluster's supported channel and limit untrusted image sources while arranging rollout.
Solspace Freeform 5.10.14 Blocks Twig Template Injection
Solspace Freeform 5.10.14 fixes limited Twig injection through public form input in certain response templates. Update through the Craft CMS workflow and test affected forms; the advisory does not demonstrate code execution or secret access.