Cyber Security Daily Radar

#advisory

共收录 23530 条相关情报。

← 返回所有主题
安全公告2026-08-13 发布INFO

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an ...

CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200#cwe-639#cwe-732#cwe-862
安全公告2026-08-13 发布INFO

Public-only API token restriction is not enforced on team API routes

CVE-2026-58431

Public-only API token restriction is not enforced on team API routes

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-863
安全公告2026-08-13 发布INFO

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-1259#cwe-284
安全公告2026-08-13 发布INFO

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-424#cwe-434
安全公告2026-08-13 发布INFO

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200#cwe-863
安全公告2026-08-13 发布INFO

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

CVE-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200#cwe-863
安全公告2026-08-13 发布INFO

Local File Inclusion via file:// URI in Migration Restore

CVE-2026-58420

Local File Inclusion via file:// URI in Migration Restore

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

REST API exposes organization membership of private organizations to public

CVE-2026-58417

REST API exposes organization membership of private organizations to public

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

Two SSRF findings in Gitea 1.26.2

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-918
安全公告2026-08-13 发布INFO

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-918
安全公告2026-08-13 发布INFO

Cross-repository issue/comment attachment re-linking can expose private attachment content

CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-639#cwe-862
安全公告2026-08-13 发布INFO

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

Privilege Escalation via Access Token Scope Escalation in API

CVE-2026-56654

Privilege Escalation via Access Token Scope Escalation in API

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-202

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-863
安全公告2026-08-13 发布INFO

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVE-2026-55987

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix o

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-863
安全公告2026-08-13 发布INFO

Email Management API Bypasses ManageCredentials Feature Restrictions

CVE-2026-55986

Email Management API Bypasses ManageCredentials Feature Restrictions

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVE-2026-55984

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-284
安全公告2026-08-13 发布INFO

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVE-2026-55982

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200
安全公告2026-08-13 发布INFO

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-295
安全公告2026-08-13 发布INFO

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-200#cwe-862