42
57
47
57
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
CVE-2026-60004 is a CWE-94 code injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, disclosed July 28, 2026 with a CVSS v3.1 score of 9.8 and credited to researcher Shai Rod (NightRang3r). An add/add collision with the three-way merge fallback (--3, Git 2.32+) writes attacker-controlled content into the temporary bare clone's hooks directory, where it executes as a live Git hook running commands as the Gitea OS user. Exploitation requires repository write access, but Gitea's default open registration allows anonymous users to obtain it, exposing app.ini secrets, database credentials, OAuth tokens, and mounted repositories; a public PoC requires no outbound callback. All releases from 1.17 through 1.27.0 are affected; the fix shipped in Gitea 1.27.1 on July 27, 2026, and Gitea Cloud instances were upgraded automatically.
55
42
57
42
57
57
42
42
42
47
cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access
Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.
cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.
65
57
42
57
42
60
57
42
42
42
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.
58
47
47
57
42
42
42
57
57
FortiOS and FortiProxy ZTNA Validation Vulnerability Allows Attacker to Perform a Man-in-the-Middle Attack
Fortinet discloses high-severity certificate validation flaw CVE-2026-84393 in FortiOS and FortiProxy Agentless ZTNA portals enabling unauthenticated man-in-the-middle attacks.
Fortinet disclosed CVE-2026-84393 (CVSSv3 7.3, CWE-295) on September 8, 2026 under advisory FG-IR-26-174: improper certificate validation in the Agentless ZTNA portal of FortiOS and FortiProxy. An unauthenticated attacker on the network path could present a forged or mismatched certificate and intercept or tamper with traffic between the portal and backend destinations, with impact classified as information disclosure. Affected versions are FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6; the 8.0, 7.4 and 7.2 branches of both products are unaffected. Fortinet urges upgrading to 7.6.7 or later and reports no evidence of exploitation in the wild.
45
57
57
57
42
57
47