https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 15:58:11 +0000 https://cve.radiocsirt.org/vuln/cve-2026-103059 <p><strong>Affected:</strong> Gitea</p> <p>When Gitea&#39;s built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user&#39;s registered RSA public key for which they can derive the private key could have that key matched to the victim&#39;s account and authenticate over SSH as that user. Keys are now looked up by fingerprint.</p> <p><strong>Affected:</strong> Gitea</p> <p>When Gitea&#39;s built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user&#39;s registered RSA public key for which they can derive the private key could have that key matched to the victim&#39;s account and authenticate over SSH as that user. Keys are now looked up by fingerprint.</p> https://cve.radiocsirt.org/vuln/cve-2026-103059