31 matches found
CVE-2026-119627
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119625
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
EUVD-2026-114808
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119625 Gitea user and organization feed token scope bypass
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
CVE-2026-119625 Gitea user and organization feed token scope bypass
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
CVE-2026-119625
The Gitea /{username} web route was vulnerable to an incorrect authorization issue (CWE-863) because it accepted personal access tokens via HTTP Basic authentication without verifying their scope. An attacker using a token with an unrelated scope (e.g., read:issue) could access a user's private a...
PT-2026-134885
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
CVE-2026-119627: Gitea: The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a…
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...
PT-2026-134884
The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...
CVE-2026-110530
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...
CVE-2026-110530
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2026.0517 . The root cause lies in the SyndicatedPost::sanitize_content() function, which fails to strip style and on[a-z]+ event-handler attributes, and the SyndicatedPost::i...
CVE-2026-110530 FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...
CVE-2026-110530 FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...
EUVD-2026-114677
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...
CVE-2026-110530: radgeek FeedWordPress: The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin's SyndicatedPost::sanitizecontent function only strips the 'target' attribute the lines that would strip 'style' and...
PT-2026-134484
Name of the Vulnerable Software and Affected Versions FeedWordPress versions prior to 2026.0518 Description Stored Cross-Site Scripting occurs via syndicated RSS/Atom feed content. The SyndicatedPost::sanitize content function fails to strip style and ona-z+ event-handler attributes. Additionally...
[SECURITY] Fedora 45 Update: newsboat-2.44-3.fc45
Newsboat is a fork of Newsbeuter, an RSS/Atom feed reader for the text consol e...
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
