CVE-2026-107618

The Gitea application is vulnerable to a cross-site request forgery (CSRF) vulnerability affecting repository topics. The issue occurs because the POST /{owner}/{repo}/topics endpoint was registered without the necessary sign-in middleware that provides cross-origin protection. Consequently, a re...

CVE-2026-107618 Gitea cross-site request forgery on repository topics

POST /owner/repo/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other reposito...

CVE-2024-51032

CVE-2024-51032 Description A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

EUVD-2026-103299

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store...

CVE-2026-111932

The Coder platform versions before 2.29.17 , 2.30.0 (before 2.32.7 ), 2.33.0 (before 2.33.8 ), and 2.34.0 (before 2.34.2 ) are vulnerable to a stored HTML injection vulnerability. The root cause is the insufficient escaping of ApplicationName and LogoURL appearance settings when rendered into HTM...

-CVE-2021-41962

-CVE-2021-41962 Description Cross Site Scripting XSS vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in a Send Service Request in vehicleservice. Additional Information NA Vulnerability Type Cross Site Scripting XSS Vendor of Product...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

CVE-2026-111621

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

EUVD-2026-103043

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

CVE-2026-111621

The TDuck Survey Form software (versions through 5.3 ) is vulnerable to a missing authorization flaw (CWE-639) in the /user/form/setting/{key} endpoint. This vulnerability allows any authenticated user to access the raw form settings of other owners by providing an 8-character form key obtained f...

PT-2026-116020

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2026-76066

IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer...

CVE-2026-110842

The n8n workflow automation tool (versions before 2.41.4 and 2.42.x before 2.42.1 ) is vulnerable to a prototype pollution vulnerability within the MCP workflow-validation tool . The root cause is that the tool's interpreter evaluates caller-supplied code in the main process, allowing for the rea...

CVE-2026-73814

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to...

CVE-2026-63792

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

CVE-2026-53612

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod and lchown operations on a previously validated mount target. A local low-privileged user authorized by a...

CVE-2026-73814

The Gitea software contains a privilege escalation vulnerability in the collaboration access-mode endpoint . An authenticated repository collaborator with Admin access can exploit this flaw to promote their permissions to Owner . Once elevated, the attacker can perform owner-only operations, such...