CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

EUVD-2026-58172

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-58445: Observable Discrepancy

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

SUSE CVE-2026-58445

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

GO-2026-6067 Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...

PT-2026-65365

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API in gitea.dev...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DeleteIssueLabel function. An attacker can determine the existence of label IDs across repositories, including those they do not have access to, by observing differing HTTP respon...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

PT-2014-3563

Name of the Vulnerable Software and Affected Versions Dell KACE K1000 management appliance version 5.5.90545 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the LABEL ID parameter in the adminui/user list.php file. This cou...