CVE-2026-55734: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian Guardian.Permissions module allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines...

CVE-2026-55733: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.toatom/1. When encode/3 in...

SUSE CVE-2026-27761

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope...

CVE-2026-54705: Improper Encoding or Escaping of Output

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the RSS/Atom feed handlers, which accept API-token Basic authentication but do not enforce token scope or public-only restrictions. An attacker can access private repository metadata, such as commit information,...

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...

PYSEC-2026-2784 Open Babel has uninitialized pointer dereference in MSI atom parser

Summary A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the atom handling of the MSI reader. A malformed record caused the parser to dereference an atom pointer that had never been...

EUVD-2026-34013

Tesla vulnerable to atom exhaustion via untrusted URL scheme...

GHSA-H74C-Q9J7-MPCM Tesla vulnerable to atom exhaustion via untrusted URL scheme

Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.openconn/2 passes the URL scheme of every outgoing request through String.toatom/1 with no allow-list validation. Because BEAM atoms are permanent never garbage-collected and the atom table is bounded at roughly...

Tesla vulnerable to atom exhaustion via untrusted URL scheme

Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.openconn/2 passes the URL scheme of every outgoing request through String.toatom/1 with no allow-list validation. Because BEAM atoms are permanent never garbage-collected and the atom table is bounded at roughly...

CVE-2026-27761

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope...

CVE-2026-27761

Gitea versions up to and including 1.26.2 expose private repository commit data via RSS/Atom feed endpoints by bypassing API access token scope checks. This affects feeds that do not enforce repository scope, allowing tokens without repository scope to access private data. Public references indic...

CVE-2026-27761 Gitea repository feeds bypass API token scope enforcement

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope...

SUSE CVE-2022-44451

A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-27761: Incorrect Authorization

Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope...

EUVD-2026-41216

A NULL pointer dereference in the AP4TkhdAtom::GetTrackId function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

EUVD-2026-41219

A NULL pointer dereference in the AP4AtomSampleTable::GetSample function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

TencentOS Server 2: microcode_ctl (TSSA-2025:1023)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1023 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...