Daily briefing · July 3, 2026
Gitea Takes Triple Hit as Critical Auth Bypass, SSRF, and Artifact Flaws Drop Simultaneously
July 3, 2026 brought 190 new vulnerabilities and seven rated critical, with no active exploitation confirmed yet — but the threat landscape is far from calm. Gitea's open-source Git server is at the center of today's bulletin, collecting three critical CVEs that together could allow impersonation, cross-repository data access, and server-side request forgery. Alongside Gitea, critical flaws in HPLIP on Red Hat Enterprise Linux, Microsoft Edge, and WordPress round out a day demanding immediate patch prioritization.
Today’s brief
- Gitea is hit with three critical vulnerabilities covering auth bypass, SSRF protection failures, and signed URL abuse — update beyond 1.26.2 immediately
- HPLIP on RHEL 10 carries a critical integer overflow (incomplete fix for a prior CVE) that can lead to remote privilege escalation or arbitrary code execution
- Microsoft Edge has a type confusion bug enabling remote code execution over a network — browser patching cannot wait
- Two path traversal flaws in Apache Lucene.Net.Replicator allow directory escape; upgrade to 4.8.0-beta00018 is the only fix
7
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
Gitea's Docker image defaults to trusting all reverse-proxy source IPs, meaning any attacker who can send HTTP headers like X-WEBAUTH-USER can impersonate any user without credentials. With a public PoC available on the same day as disclosure, exploitation by opportunistic actors is a near-certainty for unpatched instances.
2
A classic SQL injection in the Destekz platform (by Raera) allows unauthenticated or low-privileged attackers to manipulate backend database queries directly. The vendor has confirmed the product is unsupported, meaning no patch will ever arrive — operators must migrate away or isolate the system entirely.
3
This critical integer overflow in HPLIP's hpcups print processing path is an incomplete fix for a previously patched CVE, meaning defenders who believed they were protected are not. A remote attacker sending crafted print data could escalate privileges or execute arbitrary code on Red Hat Enterprise Linux 10 systems.
4
An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows an attacker to read artifacts from repositories they should not access and write upload state across task boundaries — a serious supply chain risk in any CI/CD pipeline hosted on Gitea.
5
Gitea's webhook and migration allow-list filtering fails to fully block SSRF attempts, meaning attackers could coerce the server into making requests to internal infrastructure or cloud metadata endpoints. This is particularly dangerous in cloud-hosted or self-hosted environments with internal services reachable from the Gitea host.
6
The Printcart WooCommerce plugin allows authenticated users to delete arbitrary files on the server by passing a crafted path through the 'nbd_item_key' POST parameter, which is only sanitized with sanitize_text_field() — insufficient to prevent path traversal. Deleting critical application or configuration files can result in full site takeover.
7
A type confusion vulnerability in Microsoft Edge (Chromium-based) enables remote code execution over a network without requiring user interaction beyond visiting a malicious resource. Given Edge's enterprise adoption, this is a high-priority browser update for corporate environments.
8
A logic flaw in Gitea's fork pull request workflow allows attackers to bypass PR approval gates permanently, undermining code review controls that teams rely on to prevent unauthorized or malicious code from being merged into protected branches.
9
A path traversal vulnerability in Apache Lucene.Net.Replicator (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows attackers to escape restricted directories, potentially reading or overwriting sensitive files on the host. Upgrading to 4.8.0-beta00018 is the vendor-recommended remediation.
10
A second path traversal CVE in the same Apache Lucene.Net.Replicator library covers a slightly different version range but carries identical risk — unauthorized filesystem access outside the intended directory. Both CVE-2026-47896 and this entry are resolved in version 4.8.0-beta00018.
Today’s recommendation: Prioritize patching Gitea beyond version 1.26.2 immediately given three concurrent critical CVEs and an available public PoC; simultaneously apply vendor patches for HPLIP on RHEL 10, update Microsoft Edge across all endpoints, and upgrade Apache Lucene.Net.Replicator to 4.8.0-beta00018. For the unsupported Destekz platform, isolation or decommissioning is the only viable defensive action.
With multiple critical flaws affecting common infrastructure components — Git servers, print stacks, browsers, and search libraries — now is the moment to validate whether any of these surfaces exist in your environment before attackers do it for you.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
September 20, 2026 — Dozens of Critical PoC Flaws Surface in Routers and Research Tools, But No Active Exploitation DetectedSeptember 19, 2026 — Calm Vulnerability Day Masks Serious Flaws in Routers, WordPress, and SuricataSeptember 18, 2026 — WordPress, IBM, and vm2 Flaws Anchor a High-Alert Day With 5 CVEs Already Under Active ExploitationSeptember 17, 2026 — Six CVSS 10.0 Azure Flaws Lead a Heavy Patch Day as Acronis Backup Plugin Faces Active ExploitationSeptember 16, 2026 — Cisco Infrastructure Flooded With CVSS 10 Flaws as VulnCheck Spots Active Exploitation Before CISASeptember 15, 2026 — Oracle Patch Tuesday Surge and Yonyou Active Exploitation Drive ATTENTION-Level AlertSeptember 14, 2026 — Cisco Secure Email Under Active Exploitation as 58 Critical CVEs SurfaceSeptember 13, 2026 — WordPress Plugin Flaw Leads Quiet Day With 8 Critical CVEs and No Active ExploitationSeptember 12, 2026 — WordPress Plugin Blitz: Nine Critical RCE and Takeover Flaws Disclosed on a Quiet Exploit DaySeptember 11, 2026 — GitLab Critical Zero-Day Under Active Exploitation Leads a Heavy Patch Day with 36 Critical CVEsSeptember 10, 2026 — Ten Critical CVEs Published on a Calm Threat Day as Brazil Faces Ransomware SurgeSeptember 9, 2026 — Three CVEs Already Exploited Before CISA Confirmation, Dual Check Point RCE and cPanel SQLi-to-Root Round Out a High-Alert DaySeptember 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on Brazilview full archive →