The day opened with CISA's KEV catalog doing the heavy lifting: a two-CVE WordPress Core chain that turns SQL injection into unauthenticated RCE on default installs, Langflow's second RCE-capable KEV entry in two weeks, and a decade-old DD-WRT UPnP overflow getting its first-ever catalog listing. All four landed with three-day due dates — CISA's tell that it has evidence of active exploitation, not just theoretical risk.
Then, starting mid-afternoon, GitHub published 21 new Gitea advisories in about two hours — four critical, seventeen high — the largest single-vendor batch this series has logged for a self-hosted git platform. The sharpest pair: the official Docker image ships REVERSE_PROXY_TRUSTED_PROXIES as a wildcard by default, so any network-reachable attacker can impersonate any user including admin via the X-WEBAUTH-USER header, and a signed-URL HMAC ambiguity in Actions Artifacts v4 lets one repository's Actions runs forge access to another repository's artifacts. The other seventeen cluster into repeating shapes — three separate SSRF findings, three DoS/ReDoS vectors, and a run of stale-permission-cache and access-control leaks across forks, labels, notifications, and LFS objects — that reads like one audit sweep finding the same bug pattern across a dozen features. Separately, GHSA flagged that a prior jackson-core fix for an async-parser number-length DoS was incomplete, closing a gap attackers could exploit by feeding digits in small chunks. The bright spot: Gitea shipped fixes for all 21 issues same-day across three point releases instead of embargoing a slow rollout, and the jackson-core follow-up shows the GHSA ecosystem catching an incomplete fix quickly rather than leaving it quiet.
→ Operational priority for the night patch every internet-facing Gitea instance tonight, starting with the Docker-image trusted-proxy default and the Actions Artifacts HMAC bug, then confirm WordPress is on 7.0.2 before Thursday's KEV due date.