Gitea: Notification API leaks private issue metadata after access revocation
CVE-2026-58419
# Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private
#severity:high
共收录 5441 条相关情报。
← 返回所有主题Gitea: Unauthorized Access to Labels of Private Organizations
CVE-2026-25038
## Summary Gitea 1.26.2 does not properly enforce organization visibility restrictions on organization label read endpo
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
CVE-2026-27775
## Vulnerability Header | Field | Value
Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private
CVE-2026-24451
### Summary The `POST /api/v1/repos/{owner}/{repo}/merge-upstream` endpoint continues to synchronize commits from a par
Gitea: Two SSRF findings
CVE-2026-58314
| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bf
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58436
### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language
Gitea: Repository Visibility Manipulation via Git Push Options
CVE-2026-58437
### Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | **Affected File** | `
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
CVE-2026-55987
## Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account (`IsActive=false`) when the user
A post-authentication command injection vulnerability in the "LogServer" field of the syslog...
CVE-2026-6952
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who...
CVE-2026-63728
Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence r
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line...
CVE-2026-64624
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the e
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
CVE-2026-59205
### Summary Pillow's public `ImageCms.ImageCmsTransform.apply(im, imOut)` API can trigger controlled native heap corrup
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
CVE-2026-59204
### Summary `src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 imag
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
CVE-2026-59200
### Summary `PdfParser.PdfStream.decode()` in Pillow's `PdfParser.py` calls `zlib.decompress()` with the `bufsize` param
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
CVE-2026-59199
### Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
CVE-2026-59197
### Summary Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd f
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
CVE-2026-50651
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
CVE-2026-50525
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
CVE-2026-50528
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
CVE-2026-50648
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET