145216 matches found
PT-2026-107172
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw exists in Gitea Actions where older runs within the same workflow-level concurrency group are cancelled upon the insertion of a new run without verifying if the new run requires approval...
PT-2026-107175
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...
PT-2026-107176
Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...
PT-2026-107220
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea Actions incorrectly determined if a fork pull request run required approval by checking the user who triggered the event instead of the pull request author. When a maintainer performed...
PT-2026-106891
Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
Security Advisory 0194
Security Advisory 0194 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description Two security vulnerabilities have been identified in Arista access point firmware affecting the Captive Portal feature. Both vulnerabilities allow an...
PT-2026-106803
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...
Next.js 15.5.6 Remote Code Execution
Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...
PT-2026-106670
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it own...
PT-2026-106581
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpm get nlmsg request iwpm get nlmsg request initializes refcount after list add tail making it accessible to global list where another CPU can kref get on nlmsg request causing a refcount "additio...
PT-2026-106298
A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an...
PT-2026-107111
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...
PT-2026-106320
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...
PT-2026-107226
Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large...
Cisco ASA Buffer Copy without Checking Size of Input (CVE-2021-1493)
A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks...
Cisco ASA Improper Input Validation (CVE-2022-20924)
A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerabili...
PT-2026-107132
Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations...
PT-2026-106296
A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundari...
PT-2026-106787
Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description A malformed multipart request body can cause the processing of the multipart Content-Type to take an excessive amount of time, leading to uncontrolled...