Northstar Security is a startup that has emerged from stealth mode with $7 million in seed funding to develop AI-driven security solutions. The company builds a real-time Security Context Graph that maps identities, assets, applications, vulnerabilities, and business systems to identify risky combinations of security issues. Its platform helps security teams detect and remediate complex risk scenarios that may not be evident when issues are considered individually. The solution integrates with over 70 enterprise security and IT products and allows analysts to interact with findings using natural language queries. Northstar’s AI agents can initiate remediation actions under supervision. The startup aims to improve security context and reduce risk exposure for organizations.
HTTP::Session versions before 0.54 for Perl contain a CRLF injection vulnerability in the HTTP::Session::Store::CHI component. This flaw allows an attacker to inject memcached commands by supplying session IDs with carriage return and line feed characters, which are not filtered or escaped by the CHI store. The vulnerability is fixed in version 0.54.
CVE-2026-120225 is a critical vulnerability in Oray Pugongying X5 Pro devices up to versions 7.6.0 and 7.6.1. It involves a relative path traversal flaw in the config_restore_ex function related to the /etc/openwrt_release file. This vulnerability can be exploited remotely and allows attackers to manipulate file paths. Public exploit code is available, but the vendor has not responded to the disclosure.
The RubyGems package 'macs-shoaibs-pro17' version 90002.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is considered malicious due to its communication with a domain linked to malicious activity. No CVSS score or detailed technical impact information is provided.
CVE-2026-120224 is a critical improper authorization vulnerability in Oray Pugongying X5 Pro versions 7.6.0 and 7.6.1. It affects the API Authorization component, specifically the run_apis_by_json and run_async_task functions. The flaw allows remote attackers to bypass authorization controls. Public exploit code has been released, increasing the risk of exploitation. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available.
CVE-2026-120223 is a vulnerability in Oray Pugongying X5 Pro up to versions 7.6.0 and 7.6.1. It affects the session_get function in the session.lua file, specifically the Session ID Handler component. The flaw involves insufficiently random values due to manipulation of the _user argument. The vulnerability can be exploited remotely but requires high attack complexity and is difficult to exploit. Public exploit code exists, but there is no indication of active exploitation in the wild. The vendor has not responded to the disclosure, and no patch or fix information is available.
CVE-2026-119627 is an access control vulnerability in Gitea affecting versions prior to 28.3.0. It allows users with a public-only personal access token to access profile and activity feed information of limited-visibility users and organizations, which should be hidden from anonymous visitors. The vulnerability exposes existence, profile metadata, and public activity but does not allow write access.
CVE-2026-119625 is an incorrect authorization vulnerability in Gitea affecting versions prior to 28.3.0. The issue involves the `/{username}` web route accepting personal access tokens over HTTP Basic authentication without properly checking token scopes. This allowed tokens with unrelated or limited scopes to access private user and organization activity feeds and private repository information. The vulnerability was fixed in version 28.3.0 by restricting token acceptance on this route to feeds requiring appropriate scopes such as `read:user` or `read:organization`.
A missing authorization vulnerability in Gitea prior to version 28.3.0 allowed repository and organization project boards to expose metadata of private pull requests referencing issues on public boards. This exposure included the private repository's path and pull request number, title, and state to anonymous viewers, though the pull request body, diff, and files were not disclosed. The issue was fixed in version 28.3.0 by skipping linked pull requests in repositories where the viewer lacks read permissions.
CVE-2026-119441 is an authorization vulnerability in Gitea affecting versions from 1.27.0 up to but not including 28.3.0. The DELETE API endpoint for deleting all repositories of an organization did not properly enforce restrictions on public-only access tokens. This allowed a public-only token belonging to an owner of a public organization to delete private repositories within that organization, which should have been inaccessible with such a token. The issue has been fixed in version 28.3.0 by rejecting public-only tokens on routes requiring organization ownership.
Gitea versions prior to 28.3.0 allowed users with permission to modify issues on archived repositories via the REST API, bypassing the web interface restriction that prevents changes on archived repositories. This could lead to unauthorized edits, closures, deletions, label changes, time tracking modifications, reactions, issue block changes, and pinning of issues in archived repositories. The issue was fixed in version 28.3.0 by applying the archived repository check to all modifying API requests.
Gitea versions prior to 28.3.0 contain a vulnerability where personal access tokens restricted to public resources ('public-only') can bypass intended restrictions and create private repositories and organizations. This occurs because certain API endpoints still accept these tokens for creating private repositories and organizations, despite the tokens being limited to public resource access. The tokens cannot read the private repositories they create. The issue was fixed in version 28.3.0.
CVE-2026-118394 is an information exposure vulnerability in Gitea's OAuth2 userinfo endpoint. The flaw caused the endpoint to incorrectly determine the scope of OAuth2 tokens, leading to unauthorized disclosure of private organization and team membership information of the token owner. No repository content was exposed. The issue is fixed in Gitea version 28.3.0.
CVE-2026-117685 is an authorization vulnerability in Gitea's OCI registry cross-repository blob mount feature. It allows a public-only token with write:package scope, whose owner has read access to a private package and write access to a public package namespace, to mount a private package blob into a public package. This misauthorization enables anyone to download the private blob via the public package.
CVE-2026-117677 is an uncontrolled resource consumption vulnerability in Gitea versions before 28.3.0. It occurs when parsing uploaded Helm charts, where the decompressed archive size is not limited before quota checks, allowing attackers with package write access to cause high CPU usage by uploading small, highly compressed archives. This can degrade the availability of the Gitea instance but does not enable code execution or unauthorized data access.
A vulnerability in Gitea before version 28.3.0 allows unauthorized users to access sensitive information from linked issues in private repositories. Specifically, dependency added and removed events expose details such as the linked issue's title, body, state, labels, poster, and attachment names through the API and web interface, even if the linked issue is in a repository the user cannot access. This exposure does not include comments or attachment downloads. The issue has been fixed in version 28.3.0.
A vulnerability in Gitea versions prior to 28.3.0 allowed personal access tokens restricted to public resources to list private repositories on user profiles and organization pages. This flaw exposed repository names and metadata but did not disclose repository content. The issue was fixed in version 28.3.0.
CVE-2026-117635 is an improper access control vulnerability in Gitea affecting versions prior to 28.3.0. The issue arises because the /api/v1/admin route group did not enforce the 'public-only' restriction on personal access tokens. This allowed a public-only token with admin scope, issued by a site administrator, to perform unauthorized actions such as listing private organizations and user email addresses, creating organizations, obtaining runner registration tokens, and creating new site administrator accounts. Notably, the created admin accounts persist even after the token is revoked. Tokens from non-administrator users cannot access these routes. The vulnerability is fixed in version 28.3.0, where public-only tokens are rejected on the admin API.
A vulnerability in Gitea Actions allows a workflow job authenticated as the system user 'gitea-actions' to register an email address and GPG key without email confirmation, causing commits signed with that key to appear as trusted and signed by the instance. This affects signature display status but does not grant access or bypass enforcement of signed commits. The issue is fixed in version 28.3.0.
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories.