https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 09:35:17 +0000 https://cve.radiocsirt.org/vuln/bit-gitea-2026-103667 <p><strong>Affected:</strong> Bitnami: gitea</p> <p>Gitea&#39;s container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.</p> <p><strong>Affected:</strong> Bitnami: gitea</p> <p>Gitea&#39;s container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.</p> https://cve.radiocsirt.org/vuln/bit-gitea-2026-103667 https://cve.radiocsirt.org/vuln/euvd-2026-383942 EUVD-2026-383942 https://cve.radiocsirt.org/vuln/euvd-2026-383942 https://cve.radiocsirt.org/vuln/fkie_cve-2026-103667 <p>Gitea&#39;s container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.</p> <p>Gitea&#39;s container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposition` or restrictive content security policy. A user who can push container images can publish a blob containing HTML and JavaScript with a `text/html` media type. When a victim who is authenticated to the instance opens the blob URL in a browser, the script runs on the Gitea origin and can perform actions as the victim, such as creating API tokens.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-103667