Daily briefing · July 3, 2026
Gitea Takes Triple Hit as Critical Auth Bypass, SSRF, and Artifact Flaws Drop Simultaneously
July 3, 2026 brought 190 new vulnerabilities and seven rated critical, with no active exploitation confirmed yet — but the threat landscape is far from calm. Gitea's open-source Git server is at the center of today's bulletin, collecting three critical CVEs that together could allow impersonation, cross-repository data access, and server-side request forgery. Alongside Gitea, critical flaws in HPLIP on Red Hat Enterprise Linux, Microsoft Edge, and WordPress round out a day demanding immediate patch prioritization.
Today’s brief
- Gitea is hit with three critical vulnerabilities covering auth bypass, SSRF protection failures, and signed URL abuse — update beyond 1.26.2 immediately
- HPLIP on RHEL 10 carries a critical integer overflow (incomplete fix for a prior CVE) that can lead to remote privilege escalation or arbitrary code execution
- Microsoft Edge has a type confusion bug enabling remote code execution over a network — browser patching cannot wait
- Two path traversal flaws in Apache Lucene.Net.Replicator allow directory escape; upgrade to 4.8.0-beta00018 is the only fix
7
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
Gitea's Docker image defaults to trusting all reverse-proxy source IPs, meaning any attacker who can send HTTP headers like X-WEBAUTH-USER can impersonate any user without credentials. With a public PoC available on the same day as disclosure, exploitation by opportunistic actors is a near-certainty for unpatched instances.
2
A classic SQL injection in the Destekz platform (by Raera) allows unauthenticated or low-privileged attackers to manipulate backend database queries directly. The vendor has confirmed the product is unsupported, meaning no patch will ever arrive — operators must migrate away or isolate the system entirely.
3
This critical integer overflow in HPLIP's hpcups print processing path is an incomplete fix for a previously patched CVE, meaning defenders who believed they were protected are not. A remote attacker sending crafted print data could escalate privileges or execute arbitrary code on Red Hat Enterprise Linux 10 systems.
4
An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows an attacker to read artifacts from repositories they should not access and write upload state across task boundaries — a serious supply chain risk in any CI/CD pipeline hosted on Gitea.
5
Gitea's webhook and migration allow-list filtering fails to fully block SSRF attempts, meaning attackers could coerce the server into making requests to internal infrastructure or cloud metadata endpoints. This is particularly dangerous in cloud-hosted or self-hosted environments with internal services reachable from the Gitea host.
6
The Printcart WooCommerce plugin allows authenticated users to delete arbitrary files on the server by passing a crafted path through the 'nbd_item_key' POST parameter, which is only sanitized with sanitize_text_field() — insufficient to prevent path traversal. Deleting critical application or configuration files can result in full site takeover.
7
A type confusion vulnerability in Microsoft Edge (Chromium-based) enables remote code execution over a network without requiring user interaction beyond visiting a malicious resource. Given Edge's enterprise adoption, this is a high-priority browser update for corporate environments.
8
A logic flaw in Gitea's fork pull request workflow allows attackers to bypass PR approval gates permanently, undermining code review controls that teams rely on to prevent unauthorized or malicious code from being merged into protected branches.
9
A path traversal vulnerability in Apache Lucene.Net.Replicator (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows attackers to escape restricted directories, potentially reading or overwriting sensitive files on the host. Upgrading to 4.8.0-beta00018 is the vendor-recommended remediation.
10
A second path traversal CVE in the same Apache Lucene.Net.Replicator library covers a slightly different version range but carries identical risk — unauthorized filesystem access outside the intended directory. Both CVE-2026-47896 and this entry are resolved in version 4.8.0-beta00018.
Today’s recommendation: Prioritize patching Gitea beyond version 1.26.2 immediately given three concurrent critical CVEs and an available public PoC; simultaneously apply vendor patches for HPLIP on RHEL 10, update Microsoft Edge across all endpoints, and upgrade Apache Lucene.Net.Replicator to 4.8.0-beta00018. For the unsupported Destekz platform, isolation or decommissioning is the only viable defensive action.
With multiple critical flaws affecting common infrastructure components — Git servers, print stacks, browsers, and search libraries — now is the moment to validate whether any of these surfaces exist in your environment before attackers do it for you.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →