PT-2026-104408

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description An improper access control issue exists where SNI-to-Host access control is not enforced. Approximately 311,500 instances are...

Gitea AddTime Function DoS

The vulnerability of the AddTime function in the routers/api/v1/repo/issuetrackedtime.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2026-51899: Improper Access Control

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

PT-2026-104338

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl log/blame/annotate...

CVE-2026-104914: Missing Authorization

MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes e.g., via the deleted-attributes search or the paginated attribute listing, the application returned soft-deleted attributes...

Gitea ListMembers Disclosure

The vulnerability of the ListMembers function in the routers/api/v1/org/member.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea RSS Atom Disclosure

The vulnerability of RSS and Atom feed handlers in the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

Gitea CheckAuthToken Function Heap Buffer Overflow

The vulnerability of the CheckAuthToken function in the services/auth/authtoken.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...

Gitea oauth2UpdateAvatarIfNeed Disclosure

The vulnerability of the oauth2UpdateAvatarIfNeed function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Disclosure Sensitive Information

The vulnerability of the httpBase function in the routers/web/repo/githttp.go file and the EarlyResponseForGoGetMeta function in the services/context/repo.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a...

Gitea ParseControlFile Function DoS

The vulnerability of the ParseControlFile function in the modules/packages/debian/metadata.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea IsMigrateURLAllowed Function Information Disclosure

The vulnerability of the IsMigrateURLAllowed function in the services/migrations/migrate.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea IntrospectOAuth Disclosure

The vulnerability of the IntrospectOAuth function in the routers/web/auth/oauth2provider.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Data Compromise

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...

Gitea Locale DoS

The vulnerability of the Locale function in the modules/web/middleware/locale.go file of the Git repository management system Gitea is related to the improper implementation of flow control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea ChangeTargetBranch Privilege Bypass

The vulnerability of the ChangeTargetBranch function in the services/pull/pull.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges or circumvent security restrictio...