112 matches found
CVE-2026-77753
The Temporary Login Without Password WordPress plugin before 1.9.9 fails to prevent a temporary user from creating an Application Password and does not revoke one when the temporary access expires or is disabled. As a result, the recipient of a temporary login retains working access to the site o...
CVE-2026-77753 Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...
CVE-2026-84804
Kimai before version 2.65.0 contains an authorization bypass in its Team Activity API endpoints. The root cause is a missing permissions_activity check when removing team access to activities, projects, and customers: authenticated users holding only the edit_team permission can revoke team acces...
CVE-2026-73733
Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should ha...
EUVD-2026-69460
Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should ha...
CVE-2026-58440
A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. Mitigation To mitigate this...
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58440
The CVE is tied to Gitea. A collaborator-held webhook remains active after revoking repo access because DeleteCollaboration cleans watches/assignees but not webhooks, enabling ongoing real-time exfiltration of private repo content at the former collaborator’s endpoint. Affected code: services/rep...
CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation...
AZL-94517 CVE-2026-18651 affecting package 389-ds-base 3.1.1-12
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...
EUVD-2026-52328
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...
SUSE CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev
Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...
GO-2026-6041 Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea
Gitea: Notification API leaks private issue metadata after access revocation in code.gitea.io/gitea...
GO-2026-6033 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev...
Gitea: Notification API leaks private issue metadata after access revocation
Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...