Published threat advisories for July 3, 2026

A critical vulnerability in Gitea Actions Artifacts could permit unauthorized cross-repository artifact reading and upload-state writing due to an HMAC ambiguity in signed URLs. This could expose sensitive information or allow unauthorized modifications to task states if the Gitea deployment is reachable.

NVD published: July 3, 2026

A critical vulnerability in Gitea's OAuth sign-in process allows administrator-disabled accounts to be silently re-enabled due to improper authorization handling on the callback. If reachable, an attacker could exploit this to regain access to previously disabled accounts. This issue poses a risk of unauthorized access

NVD published: July 3, 2026

A type confusion vulnerability in Microsoft Edge could allow an unauthorized attacker to execute code over a network. While the potential impact is severe, exploitation may require specific conditions, making direct, unsolicited remote exploitation unlikely. The primary concern is confirming relevance and exposure to a

NVD published: July 3, 2026

A vulnerability exists in Gitea where errors in processing input can bypass branch protection checks, potentially allowing unauthorized code changes. This could impact the integrity of code repositories if the technology is exposed. Confirming Gitea's relevance and reviewing its exposure is advised.

NVD published: July 3, 2026

Gitea contains incomplete server-side request forgery protection in its webhook and migration filtering. An attacker with authenticated access could exploit this to trick the system into making unintended requests to internal or external network resources, potentially exposing information or affecting service behavior.

NVD published: July 3, 2026

A vulnerability in Gitea's default Docker image configuration allows any source IP to impersonate a user if reverse-proxy authentication headers are enabled, potentially exposing user accounts and enabling unauthorized actions. The default setting, which trusts all IP addresses for proxy authentication, presents a risk

NVD published: July 3, 2026

Gitea's repository archive download functionality has a vulnerability that bypasses token scope checks, potentially allowing unauthorized access to sensitive code. This issue could lead to the unauthorized disclosure of repository data if the web archive download endpoint is reachable. Understanding your organization's

NVD published: July 3, 2026

A heap out-of-bounds read vulnerability exists in the Net::IP::LPM Perl module, allowing for unbounded prefix lengths during trie construction. This flaw can cause an out-of-bounds read, potentially leading to application crashes when detected by memory-checking tools, though the issue is contained and not exposed via

NVD published: July 3, 2026

An SQL injection vulnerability in the Destekz platform may allow unauthorized access to or manipulation of data. Given the product is unsupported, organizations using it should confirm its presence to assess potential exposure and data compromise risks.

NVD published: July 3, 2026

A flaw in HPLIP, HP Linux Imaging and Printing Software, may allow a remote attacker to escalate privileges or execute arbitrary code. This can happen via an integer overflow in hpcups when processing specially crafted print data. The concern is that this could lead to unauthorized system control.

NVD published: July 3, 2026

A critical vulnerability exists in libcurl where proxy authentication credentials are not cleared, potentially leading to the reuse of old credentials for subsequent data transfers. This could result in unauthorized access to sensitive information or systems if an application using the library is exploited. Its impact

NVD published: July 3, 2026

A vulnerability in the libcurl library allows proxy authentication state to leak between sequential transfers when reusing handles with environment-variable proxy configurations. If a transfer authenticates with one proxy using Digest auth, subsequent transfers to a different proxy may erroneously include the prior aut

NVD published: July 3, 2026

A vulnerability in curl may cause it to incorrectly use credentials from a `.netrc` file when a username is specified in a URL but no password. This could lead to the misuse of another user's password for the same host, potentially exposing sensitive information.

NVD published: July 3, 2026

A vulnerability exists in curl's SASL authentication logic where the GSASL context could be freed twice. This double-free condition, if reachable, could allow for compromise of confidentiality, integrity, and availability. You should care because this could lead to system compromise or denial-of-service conditions.

NVD published: July 3, 2026

A flaw in curl's cookie parsing logic allows a malicious server to inject 'super cookies' that bypass security checks, enabling the client to send cookies to unrelated third-party domains. This could lead to unauthorized access or impersonation.

NVD published: July 3, 2026

A vulnerability in libcurl could allow an attacker to cause an `Authorization` header intended for one server to be sent to a different server. This occurs when a transfer using Digest authentication to a specific host is followed by another transfer to a different host using the same connection handle. The issue could

NVD published: July 3, 2026

A vulnerability exists in libcurl's connection pooling where a connection might improperly retain default CA trust after an application switches to custom CA material. This could potentially allow bypass of intended security validations if a connection handle is reused with differing trust stores, though the specific i

NVD published: July 3, 2026

A use-after-free vulnerability exists in libcurl when an application configures HTTP/2 stream dependencies, resets the handle, and then cleans it up, leading to potential crashes or unexpected behavior. While rated critical, exploitation requires specific, complex application-level programming, making direct external n

NVD published: July 3, 2026

A vulnerability in the Printcart Web to Print Product Designer for WooCommerce WordPress plugin allows unauthenticated attackers to delete arbitrary files on the server. This could lead to service disruption or remote code execution. Confirmation of the plugin's presence and internet accessibility is needed to assess r

NVD published: July 3, 2026

Gardyn devices have a critical vulnerability where a privileged key can be exposed, potentially allowing attackers to view connection information for all devices, execute commands on specific devices, and move to other network devices.

NVD published: July 3, 2026

WatchGuard Fireware OS has a race condition in its Mobile User VPN with IKEv2 LDAP authentication that could allow a remote, unauthenticated attacker to execute arbitrary code. This affects firewalls configured to use an external LDAP server for VPN authentication. Attackers could potentially compromise the integrity a

NVD published: July 3, 2026