GHSA-RWJ8-PGH3-R573 GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Summary Repo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from...

Gitea: Webhook Authorization Header Returned in Plaintext via API

Summary The ToHook function in services/webhook/general.go decrypts the webhook's HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. Any repository admin can read the full plaintext value of webhook authorization headers Bearer tokens, Basic aut...

GHSA-44QC-PGVP-WX7V Gitea: Notification API leaks private issue metadata after access revocation

Summary An information disclosure issue in the Gitea Notification API allows users who have lost access to a private repository to continue accessing private issue or pull request information through existing notification threads. Although repository information is hidden after access revocation,...

EUVD-2026-41619

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private...

CVE-2026-62517

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-62498

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow...

CVE-2026-62443

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract...

CVE-2026-61274

CVE-2026-61274 affects Oracle E-Business Suite’s Oracle Product Hub, specifically the Item Catalog component, with affected versions 12.2.3–12.2.15. The vuln is exploitable by a low-privilege attacker over HTTP with network access, leading to unauthorized read, and potential unauthorized update/i...

CVE-2026-61100

...

CVE-2026-61094

CVE-2026-61094 affects Oracle MySQL Server (Server: Replication) and MySQL Cluster. Affected versions include MySQL Server 8.4.0–8.4.10 and 9.7.0–9.7.1; MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, and 9.7.0–9.7.1. The vulnerability is exploitable with network access via multiple protocols and can l...

CVE-2026-60907

The CVE-2026-60907 entry concerns Oracle E-Business Suite, Oracle Installed Base, component: Create Item Instance. Affected versions are 12.2.4–12.2.15. The issue is exploitable with network access via HTTP by a low-privilege attacker, leading to unauthorized update/insert/delete of Oracle Instal...

CVE-2026-60663

...

CVE-2026-60665

...

CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-60354

...

CVE-2026-60332

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication GCS. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows...

CVE-2026-60315

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticate...

CVE-2026-47039

CVE-2026-47039 affects the Java VM component of Oracle Database Server. Affects Oracle Database Server Java VM in versions 19.3–19.31, 21.3–21.22, and 23.4.0–23.26.2. The vulnerability allows a low-privilege attacker with Create Session and network access via Oracle Net to compromise the Java VM,...

CVE-2026-46985

CVE-2026-46985 concerns Oracle Enterprise Manager Base Platform, specifically the Agent Next Gen component, with affected versions 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with network access over HTTPS to read a subset of data, per CVSS 3.1 base score 5.3 (Confidential...

EUVD-2026-46419

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...