PT-2026-104067

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

PT-2026-104265

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every...

PT-2026-104354

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.9.1 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 4.4.9.1 or later...

EUVD-2026-91702

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

EUVD-2026-91757

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

Gitea Privilege Escalation

The vulnerability of the CreateAccessToken function in the routers/api/v1/user/app.go file and the reqBasicOrRevProxyAuth function in the routers/api/v1/api.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a...

Gitea parseKeyString SSH Key Parse

The vulnerability of the parseKeyString function in the models/asymkey/sshkeyparse.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause service failures...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

Gitea /login/oauth/userinfo Data Compromise

The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

Gitea oauth2UpdateAvatarIfNeed Disclosure

The vulnerability of the oauth2UpdateAvatarIfNeed function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Locale DoS

The vulnerability of the Locale function in the modules/web/middleware/locale.go file of the Git repository management system Gitea is related to the improper implementation of flow control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea IsMigrateURLAllowed Function Information Disclosure

The vulnerability of the IsMigrateURLAllowed function in the services/migrations/migrate.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Data Compromise

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

Gitea API Endpoint Protected Information Exposure

The vulnerability of the endpoint /api/v1/teams/teamid of the Gitea Git repository management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea DeleteCollaboration Disclosure

The vulnerability of the DeleteCollaboration function in the services/repository/collaboration.go file of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Path Traversal

The vulnerability of the Git repository management system Gitea’s path/owner/repo is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to expose the protected information...

Gitea ToHook Function Information Disclosure

The vulnerability of the ToHook function in the services/webhook/general.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by this functio...

Gitea CheckAuthToken Function Heap Buffer Overflow

The vulnerability of the CheckAuthToken function in the services/auth/authtoken.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the...

Gitea ParseControlFile Function DoS

The vulnerability of the ParseControlFile function in the modules/packages/debian/metadata.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea ListMembers Disclosure

The vulnerability of the ListMembers function in the routers/api/v1/org/member.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...