Gitea: Repository Visibility Manipulation via Git Push Options
CVE-2026-58437
### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `
#advisory
共收录 23779 条相关情报。
← 返回所有主题Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
CVE-2026-55987
## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user
libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18
CVE-2026-45383
libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
CVE-2026-47708
MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name`
Shelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data
CVE-2026-47697
Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace).
Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
CVE-2026-47237
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to versio
MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow
CVE-2026-47690
MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
CVE-2026-46556
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Req
QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
CVE-2026-16318
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store th
FileGator privilege escalation
CVE-2026-63358
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to P
Trezor Safe improper security check in on-device display
CVE-2026-65058
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip155
Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
CVE-2026-16317
Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-mi
Capstone has a NULL Pointer Dereference with 3DNow! opcodes
CVE-2026-47143
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMR
Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets
CVE-2026-47671
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost c
Klever-Go KVM read-only execution can commit contract delete and upgrade side effects
CVE-2026-46403
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithT
Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes
CVE-2026-15957
Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface
DHIS2 SQL injection in SQL View filter values
CVE-2026-55082
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL
DHIS2 Reflected XSS in OpenAPI HTML scope parameter
CVE-2026-55081
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2
【云联网】入方向流量处理费免费额度延期及调整通知
【云联网】入方向流量处理费免费额度延期及调整通知
【数据库一体机 TData】关于 API 接入 CAM 鉴权的公告
【数据库一体机 TData】关于 API 接入 CAM 鉴权的公告