pwned.coffeeUpdated 46 min ago

The menu

CI servers

Operational

Nothing about CI servers is on fire right now. We'd tell you. Probably.

7 spills in 2026 for CI servers

Week of 20 Apr 2026: 1 newWeek of 3 Aug 2026: 1 newWeek of 24 Aug 2026: 2 newWeek of 31 Aug 2026: 1 newWeek of 7 Sept 2026: 1 newWeek of 28 Sept 2026: 1 new
Worst week: 24 Aug 2026, 2 new spills.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled gitea.com/gitea/runner (go) act_runner appends workflow-controlled jobs.<job>.container.options directly to the Docker HostConfig for the job container. When runner privileged mode is disabled, only Privileged is forced false. Host namespace flags, capability expansion, and security profile overrides from workflow YAML are preserved in the final HostConfig. A… fixed in gitea.com/gitea/runner 1.0.9-0.20260731160927-34bfa1915022CVE-2026-738024 sources
  2. exploitedhighpatched JFrog Artifactory Incorrect Authorization Vulnerability JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. Can be chained with CVE-2026-42018. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-25). CVE-2026-42016CVE-2026-420184 sources
  3. exploitedhighpatched JFrog Artifactory Improper Authentication Vulnerability JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-05). CVE-2026-823293 sources
  4. exploitedhighpatched JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. Added to CISA KEV on 2026-08-27 (federal deadline 2026-09-10). CVE-2026-663843 sources
  5. exploitedhighpatched Gitea Code Injection Vulnerability Gitea Gitea Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA KEV on 2026-08-25 (federal deadline 2026-08-28). CVE-2026-600042 sources
  6. exploitedcriticalpatched JetBrains TeamCity Deserialization of Untrusted Data Vulnerability JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. Added to CISA KEV on 2026-08-05 (federal deadline 2026-08-08). CVE-2026-630773 sources
  7. exploitedcriticalpatched JetBrains TeamCity Relative Path Traversal Vulnerability JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. Added to CISA KEV on 2026-04-20 (federal deadline 2026-05-04). CVE-2024-271993 sources

More in Servers

Follow CI servers

RSS: /feed.xml?stack=ci. JSON: /incidents.json?stack=ci. Or add it to your usual for delivery.