174644 matches found
CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...
CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-55986
Email Management API Bypasses ManageCredentials Feature Restrictions...
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-67614 CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...
CVE-2026-67614
CVE-2026-67614 affects CyberPanel prior to 3.0.0. A hard-coded JWT secret in the WebTerminal FastAPI SSH service allows unauthenticated remote attackers to forge valid tokens and obtain an interactive root shell via WebSocket on port 8888. An attacker can craft a forged JWT signed with the hardco...
CVE-2026-58431
CVE-2026-58431 : Gitea fails to enforce public-only API token restrictions on team routes, enabling a token scoped to public access to retrieve private team repositories and activity metadata via /api/v1/teams/{teamid} (and related endpoints). The issue stems from improper token scope/org visibil...
CVE-2026-56750
CVE-2026-56750 describes a vulnerability in Gitea where Remember-Me tokens fail to invalidate prior attacker sessions, enabling session persistence after compromise. The root cause is described as deficiencies in access control, potentially enabling privilege-related impact. Publicly documented i...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
EUVD-2026-58145
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
EUVD-2026-58132
A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...
CVE-2024-3379
creationtimestamp| type| source ---|---|--- 2026-08-13 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msxzmn3vid2f...
Exploit for Missing Authentication for Critical Function in Cpanel
CVE-2026-41940 ⚠ This tool is created solely for education...
Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Overview Affected versions of this package are vulnerable to Improper Enforcement of Message Integrity During Transmission in a Communication Channel via the negotiation process between GSSAPI and TLS encryption. An attacker can bypass intended authentication and encryption requirements by...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the authentication process. An attacker can determine whether a specific user exists by observing differences in the SCRAM authentication challenge when the targeted user has a non-default scramiterations value...