Daily briefing · July 3, 2026
Gitea Takes Triple Hit as Critical Auth Bypass, SSRF, and Artifact Flaws Drop Simultaneously
July 3, 2026 brought 190 new vulnerabilities and seven rated critical, with no active exploitation confirmed yet — but the threat landscape is far from calm. Gitea's open-source Git server is at the center of today's bulletin, collecting three critical CVEs that together could allow impersonation, cross-repository data access, and server-side request forgery. Alongside Gitea, critical flaws in HPLIP on Red Hat Enterprise Linux, Microsoft Edge, and WordPress round out a day demanding immediate patch prioritization.
Today’s brief
- Gitea is hit with three critical vulnerabilities covering auth bypass, SSRF protection failures, and signed URL abuse — update beyond 1.26.2 immediately
- HPLIP on RHEL 10 carries a critical integer overflow (incomplete fix for a prior CVE) that can lead to remote privilege escalation or arbitrary code execution
- Microsoft Edge has a type confusion bug enabling remote code execution over a network — browser patching cannot wait
- Two path traversal flaws in Apache Lucene.Net.Replicator allow directory escape; upgrade to 4.8.0-beta00018 is the only fix
7
critical
0
Actively exploited
0
Before CISA
0
Weaponized
Critical highlights
1
Gitea's Docker image defaults to trusting all reverse-proxy source IPs, meaning any attacker who can send HTTP headers like X-WEBAUTH-USER can impersonate any user without credentials. With a public PoC available on the same day as disclosure, exploitation by opportunistic actors is a near-certainty for unpatched instances.
2
A classic SQL injection in the Destekz platform (by Raera) allows unauthenticated or low-privileged attackers to manipulate backend database queries directly. The vendor has confirmed the product is unsupported, meaning no patch will ever arrive — operators must migrate away or isolate the system entirely.
3
This critical integer overflow in HPLIP's hpcups print processing path is an incomplete fix for a previously patched CVE, meaning defenders who believed they were protected are not. A remote attacker sending crafted print data could escalate privileges or execute arbitrary code on Red Hat Enterprise Linux 10 systems.
4
An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows an attacker to read artifacts from repositories they should not access and write upload state across task boundaries — a serious supply chain risk in any CI/CD pipeline hosted on Gitea.
5
Gitea's webhook and migration allow-list filtering fails to fully block SSRF attempts, meaning attackers could coerce the server into making requests to internal infrastructure or cloud metadata endpoints. This is particularly dangerous in cloud-hosted or self-hosted environments with internal services reachable from the Gitea host.
6
The Printcart WooCommerce plugin allows authenticated users to delete arbitrary files on the server by passing a crafted path through the 'nbd_item_key' POST parameter, which is only sanitized with sanitize_text_field() — insufficient to prevent path traversal. Deleting critical application or configuration files can result in full site takeover.
7
A type confusion vulnerability in Microsoft Edge (Chromium-based) enables remote code execution over a network without requiring user interaction beyond visiting a malicious resource. Given Edge's enterprise adoption, this is a high-priority browser update for corporate environments.
8
A logic flaw in Gitea's fork pull request workflow allows attackers to bypass PR approval gates permanently, undermining code review controls that teams rely on to prevent unauthorized or malicious code from being merged into protected branches.
9
A path traversal vulnerability in Apache Lucene.Net.Replicator (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows attackers to escape restricted directories, potentially reading or overwriting sensitive files on the host. Upgrading to 4.8.0-beta00018 is the vendor-recommended remediation.
10
A second path traversal CVE in the same Apache Lucene.Net.Replicator library covers a slightly different version range but carries identical risk — unauthorized filesystem access outside the intended directory. Both CVE-2026-47896 and this entry are resolved in version 4.8.0-beta00018.
Today’s recommendation: Prioritize patching Gitea beyond version 1.26.2 immediately given three concurrent critical CVEs and an available public PoC; simultaneously apply vendor patches for HPLIP on RHEL 10, update Microsoft Edge across all endpoints, and upgrade Apache Lucene.Net.Replicator to 4.8.0-beta00018. For the unsupported Destekz platform, isolation or decommissioning is the only viable defensive action.
With multiple critical flaws affecting common infrastructure components — Git servers, print stacks, browsers, and search libraries — now is the moment to validate whether any of these surfaces exist in your environment before attackers do it for you.New vulnerabilities surface every day — does your defense keep up? Get a free initial review of your attack surface.Meet the Autonomous AI Pentest Agent →Previous briefings
September 8, 2026 — Windows Under Active Exploit, ScreenConnect Zero-Day Detected Before CISA: September 8 Security BulletinSeptember 7, 2026 — 22 Critical CVEs Published on a Quiet Day, With Heavy Ransomware Pressure on BrazilSeptember 6, 2026 — Quiet Day Hides Real Risks: Tenda HG10, NEC UNIVERGE, and Brazilian Ransomware Surge Demand AttentionSeptember 5, 2026 — WordPress Plugin Wave and Tenda CP3 Flaws Lead a Calm But CVE-Heavy DaySeptember 4, 2026 — WordPress Plugins and FreeIPMI Lead a Calm but Patch-Heavy DaySeptember 3, 2026 — Four CVSS 10.0 Critical CVEs Headline a Calm But Dense Vulnerability DaySeptember 2, 2026 — WordPress Plugins Under Fire, Cisco IOS XR and NX-OS in the Crosshairs: ATTENTION Day With Active ExploitationSeptember 1, 2026 — Active Exploitation of Proxmox and SonicWall SMA1000 Leads a High-Alert DayAugust 31, 2026 — WordPress Plugins and Tenda Routers Dominate a High-Alert Day With 41 Critical CVEsAugust 30, 2026 — Calm Day Hides Sharp Edges: Critical Code Injection and Router Flaws Top August 30 BulletinAugust 29, 2026 — Ten Active-Exploitation CVEs Dominate as Ransomware Groups Hammer BrazilAugust 28, 2026 — 10 Actively Exploited CVEs Demand Immediate Action: Metabase, VMware, macOS, Cisco, and More Under FireAugust 27, 2026 — Router Firmware Under Active Exploitation and WordPress Wave Raises Alerts on August 27August 26, 2026 — Ubiquiti UniFi and Gitea Face Active Exploitation Alerts as 62 Critical CVEs Emergeview full archive →