CVE-2026-55982

The Gitea application is vulnerable to an issue where the OIDC userinfo Endpoint returns identity claims without enforcing API token scopes . This vulnerability allows for the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea v1.27.0 , which includes fixe...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105

The Git repository management system Gitea contains a vulnerability in its RSS and Atom feed handlers due to a lack of access control. This flaw allows an attacker to bypass API-token scope and public-only confinement , potentially leading to information disclosure or an increase in privileges . ...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

EUVD-2026-58136

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-72741: Authorization Bypass Through User-Controlled Key

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterpris...

CVE-2026-58431: Incorrect Authorization

Public-only API token restriction is not enforced on team API routes...

PT-2026-71718

Name of the Vulnerable Software and Affected Versions Rainbond versions prior to 6.9.8 Description Broken access control exists in the CheckToken function. Authenticated attackers can access unauthorized enterprise resources by substituting another enterprise's tenant name within URL paths. By...

CVE-2026-50105: Exposure of Sensitive Information to an Unauthorized Actor

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-18678

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-18678

The CVE affects Kong Mesh/Kuma’s kumactl when adding an HTTPS control-plane profile without a CA certificate. The root cause is that kumactl disables TLS verification and sends API tokens over an unverified connection. This allows an attacker on the network path between the operator and the contr...

CVE-2026-18678 Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

EUVD-2026-57425

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...