CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58440

The CVE is tied to Gitea. A collaborator-held webhook remains active after revoking repo access because DeleteCollaboration cleans watches/assignees but not webhooks, enabling ongoing real-time exfiltration of private repo content at the former collaborator’s endpoint. Affected code: services/rep...

SUSE CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked - ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

EUVD-2025-58440

Malicious code in mahesa-rawon31-sluey npm...

CVE-2025-58440

creationtimestamp| type| source ---|---|--- 2025-09-04 23:46:23+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/50297 2025-09-05 03:00:06+00:00| published-proof-of-concept| Telegram/NZwdyKg3sBlOoVab8mtW04AyfXZ90mr3x5yRa5cUHgMy8 2025-09-05 03:37:38+00:00| published-proof-of-concept|...

CVE-2025-58440

...

CVE-2025-58440

CVE-2025-58440 concerns the unisharp/laravel-filemanager package (versions around 2.11). Connected sources describe a Remote Code Execution (RCE) via file upload: improper validation allows attackers to disguise a PHP payload as an image by appending a dot to the .php extension and embedding a GI...