GHSA-2FCR-JFVC-VGG2 Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

CVE-2026-64878

creationtimestamp| type| source ---|---|--- 2026-07-21 21:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6piiv7552i 2026-07-21 23:42:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6ye6zujs23 2026-08-13 08:46:35+00:00| seen|...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

GHSA-MHM7-754M-9P8W jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`

Summary In BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId, the active-view @JsonView filter was applied only to the regular bean-property branch; the creator-property branch performed no creatorProp.visibleInViewactiveView check. A constructor parameter annotated with both...

CVE-2026-16361

creationtimestamp| type| source ---|---|--- 2026-07-21 19:28:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6k4uz5j62u 2026-07-22 04:46:03+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 23:36:04+00:00| see...

CVE-2026-63866

A flaw was found in the Linux kernel's mt76 Wi-Fi driver for mt7996 devices. This vulnerability occurs when the mt7996macstadeinitlink routine fails to properly clear a Wireless Client ID WCID pointer when removing a station link. This improper handling of the WCID pointer may lead to a resource...

CVE-2026-59145 Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

CVE-2026-15342 CVE-2026-15342

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...

CVE-2026-15829

CVE-2026-15829 affects googleapis/mcp-toolbox (bigquery-forecast). The prebuilt forecasting tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) into a generated AI.FORECAST query via fmt.Sprintf without re-validation, enabling SQL injection (CWE-89) and a security bo...

libssh: libssh: denial of service via unchecked ProxyCommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

CVE-2026-16450

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

CVE-2026-16450 zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

EUVD-2026-46283

A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/system/sys/dept/page of the component MyBatis-Plus Tenant Plugin. Such manipulation of the argument X-Tenant-Id leads to authorization...

CVE-2026-16450

The CVE-2026-16450 issue affects zsadmin2025 ZS-Admin (up to commit b52e14536d59fda11e56e2536a1c32e82a38cead) in the MyBatis-Plus Tenant Plugin, specifically the function getTenantId in /api/system/sys/dept/page. The underlying problem is manipulation of the X-Tenant-Id argument, which leads to a...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: pulumi, saf, code-server, npm, sqlpad, prism, lerna, kubeflow-centraldashboard...

EUVD-2026-46261

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...

UBUNTU-CVE-2026-15226

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler snap-confine. The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or...

CVE-2026-16400

creationtimestamp| type| source ---|---|--- 2026-07-21 13:55:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5xkqrkh224 2026-07-22 04:47:34+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722...