https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:38:22.257576+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352798 EUVD-2026-352798 2026-10-03T20:38:22.260213+00:00 EUVD-2026-352798 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58314 fkie_cve-2026-58314 2026-10-03T20:38:22.260244+00:00

Two SSRF findings in Gitea 1.26.2

 https://cve.radiocsirt.org/vuln/ghsa-2fcr-jfvc-vgg2 GHSA-2fcr-jfvc-vgg2 — Gitea: Two SSRF findings 2026-10-03T20:38:22.260285+00:00

Affected: Go: code.gitea.io/gitea

| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing | | Source review | `git checkout v1.26.2` (commit `2c749ce`) | | Reproduction | `bash run_poc.sh` (single shot: brings up containers, runs three PoCs, prints captured evidence, tears down on exit) | | Files touched by the fixes | `modules/hostmatcher/hostmatcher.go`, `modules/auth/openid/openid.go` |

## Summary

Gitea guards outbound HTTP from webhooks and repo migration with `net.Dialer.Control`, the correct hook point. The IP classifier behind it misses ten address families, of which CGNAT (100.64.0.0/10) is the practically important one because it is plain IPv4 and is used today by Tailscale, AWS VPC secondary CIDRs, and several Kubernetes pod-CIDR conventions. Any logged-in user can create a webhook pointing at an internal CGNAT host. The full HTTP response from that host (status, headers, body up to 1 MB) is stored in the webhook delivery log and rendered to the webhook owner on the hook detail page. The same gap applies to repo migration.

Separately, the OpenID sign-in form at `/user/login/openid` fetches the user-supplied provider URL server-side via `openid-go`, which uses `http.DefaultClient`. No `hostmatcher`, no IP filter, no CSRF, no authentication. When OpenID sign-in is enabled, anyone on the internet can drive Gitea into making arbitrary GET requests aga…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 WID-SEC-W-2026-2304 — Gitea: Mehrere Schwachstellen 2026-10-03T20:38:22.260365+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.