1096 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the GetActionsUserRepoPermission function. An attacker can gain unauthorized read access to the contents of a private repository by exploiting a missing permission check when a collaborative owner is configur...
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...
GHSA-FJ8V-HJWV-QM88 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...
PT-2026-63291
Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A confidentiality breach exists where an attacker-controlled fork pull-request workflow can gain read access to a third private repository. This occurs because the GetActionsUserRepoPermission function in...
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that its sibli...
CVE-2026-58487 HedgeDoc: Stored HTML injection via email local-part
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a...
PYSEC-2026-2762 Read-Only Open WebUI Users Can Modify Collaborative Documents via Socket.IO
Read-Only Users Can Modify Collaborative Documents via Socket.IO Affected Component Socket.IO collaborative document editing handler: - backend/openwebui/socket/main.py lines 667-721, ydoc:document:update handler Affected Versions Current main branch and likely all versions with collaborative not...
PYSEC-2026-2697 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...
PT-2026-57912
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a...
VulnCheck KEV: CVE-2026-45586
Improper link resolution before file access 'link following' in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally...
exploitarium
If you wish to collaborate/discuss with me, contact me on discor...
CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy
Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last...
The vulnerability of the Collaborative Translation Framework (CTFMON) subsystem in Windows operating systems, which allows a hacker to increase their privileges
The vulnerability of the Collaborative Translation Framework CTFMON in Windows operating systems is related to the improper handling of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-45586 Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
...
CVE-2026-45586 Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
...
CVE-2026-45586
CVE-2026-45586 affects the Windows Collaborative Translation Framework (CTFMON). The root cause is improper link resolution before file access (link following), enabling local elevation of privileges when exploited by an authenticated attacker. Microsoft’s June 2026 patch releases (KB5094041/KB50...
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
Improper link resolution before file access 'link following' in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally...
CVE-2026-45586: Improper Link Resolution Before File Access
Improper link resolution before file access 'link following' in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally...
PT-2026-47978
Name of the Vulnerable Software and Affected Versions Windows Collaborative Translation Framework affected versions not specified Description Improper link resolution before file access, known as link following, in the Windows Collaborative Translation Framework allows an authorized attacker to...