266 matches found
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
Gitea did not reject personal access tokens restricted to public resources public-only on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with write:organization that...
CVE-2026-116289
Gitea fails to reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint. Because the resulting runner is not restricted to public repositories, an attacker possessing a write:organization token belonging to a public ...
CVE-2022-36804
CVE-2022-36804 PoC This repo contains a simple proof of concept exploit for the recent BitBucket remote code execution vulnerability CVE-2022-36804. Exploitation of this vulnerability requires access to a repository on the target instance, if you don't have creds, the target will need to have...
EUVD-2026-114679
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-114217 Konflux-ci: github token plaintext exposure in ci/cd scripts
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-114217 Konflux-ci: github token plaintext exposure in ci/cd scripts
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-114217
A flaw in konflux-ci allows continuous integration (CI) automation scripts to store sensitive GitHub access tokens in plaintext on the runner. Because these credentials are not cleaned up after execution, a local attacker with access to the CI environment can read them to gain unauthorized reposi...
CVE-2026-114217 Konflux-ci: github token plaintext exposure in ci/cd scripts
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-114217: A flaw was found in konflux-ci
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-114217
A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...
CVE-2026-70406
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
EUVD-2026-101096
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
CVE-2026-70406
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70406): Gitea -- multiple vulnerabilities
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
PT-2026-114258
Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head...
CVE-2026-105445 Docker Hub account conversion could reassign an active personal access token to another user
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token PAT they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then...