CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191

CVE-2026-47191 affects the kas setup tool for BitBake-based projects. Before version 5.3, reliant on a git commit ID (SHA-1/SHA-256) to validate repository state could mislead users into checking out a branch with the same name, potentially indicating a repository takeover. The primary impact con...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-58443

Public-only repository tokens can update private PR head branches...

CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58443 Public-only repository tokens can update private PR head branches

Public-only repository tokens can update private PR head branches...

EUVD-2026-58170

Public-only repository tokens can update private PR head branches...

CVE-2026-58443

The Gitea repository management system is vulnerable to an authorization and token scope bypass where public-only repository tokens can be used to update private PR head branches . This issue impacts the application's access control mechanisms. Remediation is available in Gitea version 1.27.0 , w...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439

The Gitea repository hosting service (specifically the go-gitea/gitea component) is vulnerable to a Branch Protection Bypass (CVE-2026-58439). The root cause is that the application preserves a stale official approval flag when a Pull Request (PR) is retargeted. This improper access control allow...

EUVD-2026-58166

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

EUVD-2026-58151

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-73608

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-73608 SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-58416: Improper Handling of Insufficient Permissions or Privileges

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

PT-2026-71436

Name of the Vulnerable Software and Affected Versions SiYuan development branch versions prior to 3.7.4 Description A missing-authorization issue exists in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and lacks necessary authorization checks, such...

CVE-2026-58439: Improper Access Control

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-15423

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...