16133 matches found
CVE-2026-26247
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26232
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
EUVD-2026-41628
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
CVE-2026-26247
Gitea versions before 1.25.5 are affected by an OAuth2 PKCE S256 verification weakness during the authorization/token-exchange flow. The underlying issue is that PKCE S256 is not persisted/validated correctly, allowing token exchange without the required verifier check. Impact is a potential acce...
CVE-2026-26232
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
EUVD-2026-41629
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26232 Gitea OAuth2 authorization codes lack expiry and reuse enforcement
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
CVE-2026-26247
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26232 Gitea OAuth2 authorization codes lack expiry and reuse enforcement
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...
CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-53478
creationtimestamp| type| source ---|---|--- 2026-07-03 15:12:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116856686523319523 2026-07-03 18:07:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr5aoq22i23 2026-07-03 18:41:00+00:00| seen|...
CVE-2026-46463
creationtimestamp| type| source ---|---|--- 2026-07-03 14:59:22+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116856636030223903 2026-07-03 17:58:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr4qg567v2r 2026-07-04 06:28:02+00:00| seen|...
CVE-2026-11778
The CVE-2026-11778 entry concerns the CURCY – Multi Currency for WooCommerce plugin for WordPress (Smoothly on WooCommerce) up to version 2.2.14. The root cause is that the plugin executes actions without proper validation of a value before running do_shortcode, enabling unauthenticated attackers...
EUVD-2026-41456
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that...
EUVD-2026-41446
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...
CVE-2026-13368
WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code in the context of the iked process on Fireboxes that...
PT-2026-55596
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software does not consistently enforce the expiry and single-use requirement of OAuth2 authorization codes during the token exchange process. OAuth2 is a standard for access delegation, allowing...
PT-2026-55597
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to correctly persist the OAuth2 PKCE S256 challenge method during the authorization process. This flaw allows for token exchange without the required verifier check. PKCE Proof Key...