Daily briefing · July 3, 2026
Gitea Takes Triple Hit as Critical Auth Bypass, SSRF, and Artifact Flaws Drop Simultaneously
July 3, 2026 brought 190 new vulnerabilities and seven rated critical, with no active exploitation confirmed yet — but the threat landscape is far from calm. Gitea's open-source Git server is at the center of today's bulletin, collecting three critical CVEs that together could allow impersonation, cross-repository data access, and server-side request forgery. Alongside Gitea, critical flaws in HPLIP on Red Hat Enterprise Linux, Microsoft Edge, and WordPress round out a day demanding immediate patch prioritization.
Today’s brief
- Gitea is hit with three critical vulnerabilities covering auth bypass, SSRF protection failures, and signed URL abuse — update beyond 1.26.2 immediately
- HPLIP on RHEL 10 carries a critical integer overflow (incomplete fix for a prior CVE) that can lead to remote privilege escalation or arbitrary code execution
- Microsoft Edge has a type confusion bug enabling remote code execution over a network — browser patching cannot wait
- Two path traversal flaws in Apache Lucene.Net.Replicator allow directory escape; upgrade to 4.8.0-beta00018 is the only fix
7
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
Gitea's Docker image defaults to trusting all reverse-proxy source IPs, meaning any attacker who can send HTTP headers like X-WEBAUTH-USER can impersonate any user without credentials. With a public PoC available on the same day as disclosure, exploitation by opportunistic actors is a near-certainty for unpatched instances.
2
A classic SQL injection in the Destekz platform (by Raera) allows unauthenticated or low-privileged attackers to manipulate backend database queries directly. The vendor has confirmed the product is unsupported, meaning no patch will ever arrive — operators must migrate away or isolate the system entirely.
3
This critical integer overflow in HPLIP's hpcups print processing path is an incomplete fix for a previously patched CVE, meaning defenders who believed they were protected are not. A remote attacker sending crafted print data could escalate privileges or execute arbitrary code on Red Hat Enterprise Linux 10 systems.
4
An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows an attacker to read artifacts from repositories they should not access and write upload state across task boundaries — a serious supply chain risk in any CI/CD pipeline hosted on Gitea.
5
Gitea's webhook and migration allow-list filtering fails to fully block SSRF attempts, meaning attackers could coerce the server into making requests to internal infrastructure or cloud metadata endpoints. This is particularly dangerous in cloud-hosted or self-hosted environments with internal services reachable from the Gitea host.
6
The Printcart WooCommerce plugin allows authenticated users to delete arbitrary files on the server by passing a crafted path through the 'nbd_item_key' POST parameter, which is only sanitized with sanitize_text_field() — insufficient to prevent path traversal. Deleting critical application or configuration files can result in full site takeover.
7
A type confusion vulnerability in Microsoft Edge (Chromium-based) enables remote code execution over a network without requiring user interaction beyond visiting a malicious resource. Given Edge's enterprise adoption, this is a high-priority browser update for corporate environments.
8
A logic flaw in Gitea's fork pull request workflow allows attackers to bypass PR approval gates permanently, undermining code review controls that teams rely on to prevent unauthorized or malicious code from being merged into protected branches.
9
A path traversal vulnerability in Apache Lucene.Net.Replicator (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows attackers to escape restricted directories, potentially reading or overwriting sensitive files on the host. Upgrading to 4.8.0-beta00018 is the vendor-recommended remediation.
10
A second path traversal CVE in the same Apache Lucene.Net.Replicator library covers a slightly different version range but carries identical risk — unauthorized filesystem access outside the intended directory. Both CVE-2026-47896 and this entry are resolved in version 4.8.0-beta00018.
Today’s recommendation: Prioritize patching Gitea beyond version 1.26.2 immediately given three concurrent critical CVEs and an available public PoC; simultaneously apply vendor patches for HPLIP on RHEL 10, update Microsoft Edge across all endpoints, and upgrade Apache Lucene.Net.Replicator to 4.8.0-beta00018. For the unsupported Destekz platform, isolation or decommissioning is the only viable defensive action.
With multiple critical flaws affecting common infrastructure components — Git servers, print stacks, browsers, and search libraries — now is the moment to validate whether any of these surfaces exist in your environment before attackers do it for you.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
August 6, 2026 — 10 Active Exploits, 1 Weaponized in a Day: Critical Alert Across WordPress, SharePoint, SonicWall, and MoreAugust 5, 2026 — Cisco SD-WAN, MarkLogic, and PraisonAI Lead a Batch of Critical CVEs on a Calm Exploitation DayAugust 4, 2026 — Quiet Day Masks 10 Critical CVEs: RCE, Auth Bypass, and Stack Overflows in FocusAugust 3, 2026 — Adobe Campaign Classic and WAPT Server Hit by Multiple CVSS 10.0 VulnerabilitiesAugust 2, 2026 — Bouncy Castle Mass Patch Day: Six Critical CVEs Drop Alongside SQL Injection and Auth Bypass FlawsAugust 1, 2026 — WordPress Auth Bypasses and FreeRDP Heap Flaws Top a Calm Vulnerability DayJuly 31, 2026 — Calm Day Hides Critical Flaws: Hard-coded Keys, File Uploads, and Code Injection Dominate July 31July 30, 2026 — 32 Critical CVEs, No Active Exploitation: Azure Cosmos DB and IBM Products Lead a Heavy Patch DayJuly 29, 2026 — Cisco FMC Under Active Exploit, Joomla Gridbox Cluster Hits Critical Mass with Four CVEsJuly 28, 2026 — Quiet Day Hides Critical Vulnerabilities: IBM WebSphere, Apache Axis2, and Joomla Top the ListJuly 27, 2026 — CVE-2026-16812: VeloCloud Orchestrator Under Active Exploitation as Critical Flaws Pile Up Across Enterprise and WordPress StacksJuly 26, 2026 — Quiet Vulnerability Day as Brazil Faces Ransomware Wave From Multiple GroupsJuly 25, 2026 — CVSS 10.0 in SiYuan and Auth Bypass in OpenRemote Lead a Calm Day for New ExploitsJuly 24, 2026 — Three CVSS 10.0 Microsoft Cloud Flaws Lead a Calm but Notable Patch Dayview full archive →