PT-2026-63298

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The /api/v1/teams/id API routes fail to correctly enforce the public-only access token restriction. A public-only token is designed to limit API access to public repositories and organizations; however, these...

PT-2026-63314

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user with package publishing permissions can cause resource amplification by uploading a specially crafted Arch package archive. The system records non-dot regular file entries...

CVE-2026-50759

CVE-2026-50759 affects exo-explore exo 1.0.69. A remote attacker can escalate privileges via unauthenticated access to GET /state and DELETE /instance/{instance_id}. The vulnerability appears to allow privilege escalation without authentication, with CVSS 3.1 base score 7.5 (HIGH) and network exp...

PT-2026-63280

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The AddTime API handler fails to stop execution after an error is returned by the GetUserByName function. When a repository administrator provides a non-existent user name, the system generates...

PT-2026-62102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. This leads to remote code execution as a...

PT-2026-63316

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw allows users whose access has been revoked to continue accessing private information through specific endpoints. A former collaborator can enumerate private repositories they previously starred and read...

PT-2026-63284

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 SSH2 public key to the SSH key ingestion endpoint. The issue stems from a normalization function...

CVE-2025-68640

The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET Private Endpoint Token to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in...

PT-2026-63312

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.4 through 2026-05-16 Description When a public repository is changed to private via the REST API, watch records are not properly cleared. This occurs because the updateRepository function, which is utilized by the PATCH...

PT-2026-62416

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

PR 38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members not just public ones of a private organization...

PT-2026-62085

Name of the Vulnerable Software and Affected Versions exo-explore exo version 1.0.69 Description An issue allows a remote attacker to escalate privileges without authentication. This is possible through the 'GET /state' and 'DELETE /instance/instance id' endpoints, where instance id is a variable...

PT-2026-62414

Name of the Vulnerable Software and Affected Versions Verba RAG application version 2.1.3 Description A server-side request forgery SSRF issue combined with a same-origin middleware bypass allows unauthenticated remote attackers to force the server to issue arbitrary HTTP requests. By providing a...

PT-2026-63289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization issue exists in the organization-level Actions REST endpoints. The endpoints /api/v1/orgs/org/actions/runs and /api/v1/orgs/org/actions/jobs only verify organization membership...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-51031

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

CVE-2026-64625

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $ and backticks. Attackers can inject arbitrary OS commands through the Live plugin onpublish.php endpoint despite escapeshellarg...

CVE-2026-64625

CVE-2026-64625 affects AVideo before 29.0. The issue stems from an incomplete fix for CVE-2026-45578: execAsync() re-wraps escaped commands in double-quoted sh -c, enabling command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.ph...