CVE-2026-26292

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-26308.8A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server whereCVE-2026-263044.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members CVE-2026-263059.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-263068.4The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an atCVE-2026-263077.5Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.CVE-2026-263088.2Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, the Envoy RBAC (Role-Based Access ContrCVE-2026-263095.3Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscapCVE-2026-26319.8The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to moCVE-2026-263107.5Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, calling Utility::getAddressWithPort witCVE-2026-263115.9Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, a logic vulnerability in Envoy's HTTP cCVE-2026-263126.5Stalwart is a mail and collaboration server. A denial-of-service vulnerability exists in Stalwart Mail Server versions 0.13.0 through 0.15.4CVE-2026-263137.5go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.17.0, an attacker can cause high