0 spills in 2025 for CI servers
Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.
Past orders
- criticalpatchedexploited Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. Added to CISA KEV on 2026-10-15 (federal deadline 2026-10-18).
- criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) ### Summary act_runner appends workflow-controlled `jobs.<job>.container.options` directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only `Privileged` is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A…
- highpatchedexploited JFrog Artifactory Incorrect Authorization Vulnerability JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Can be chained with CVE-2026-42018. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-25).
- highpatchedexploited JFrog Artifactory Improper Authentication Vulnerability JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05).
- highpatchedexploited JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27 (federal deadline 2026-09-10).
- highpatchedexploited Gitea Code Injection Vulnerability Gitea Gitea Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25 (federal deadline 2026-08-28).
- criticalpatchedexploited JetBrains TeamCity Deserialization of Untrusted Data Vulnerability JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05 (federal deadline 2026-08-08).
- criticalpatchedexploited JetBrains TeamCity Relative Path Traversal Vulnerability JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04).
Follow CI servers
RSS: /feed.xml?stack=ci. JSON: /incidents.json?stack=ci. Or add it to your usual for delivery.