CVE-2026-84473

The ownCloud server version 10.16.3 is vulnerable to an Authentication Bypass caused by Missing Brute-Force Protection in the remote.php/webdav/ endpoint. This flaw allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts by sending repeated ...

CVE-2026-117619

A flaw was found in Jenkins. An attacker who has obtained a user's API token can exploit this vulnerability by submitting HTTP Basic authentication requests to acquire a persistent 'remember me' session cookie. This allows the attacker to maintain unauthorized access to Jenkins even after the...

PT-2026-138388

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 11.1.0 Description An unauthenticated remote attacker can perform unlimited online password guessing against WebDAV accounts. This is possible due to missing brute-force protection in the 'remote.php/webdav/' endpoin...

CVE-2026-119625

A flaw was found in Gitea. The user profile web route accepts personal access tokens through HTTP Basic authentication without properly verifying their assigned permission scopes. An authenticated attacker possessing a token with limited permissions can bypass intended scope restrictions to view...

CVE-2026-119627

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119625

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119627

The Gitea instance is vulnerable to information disclosure because web profile and RSS/Atom feed routes do not enforce the public-only restriction on personal access tokens. An authenticated user with a public-only token can bypass visibility controls via HTTP Basic authentication to view the pro...

CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

EUVD-2026-114808

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

EUVD-2026-114807

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

PT-2026-134885

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119627: Gitea: The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a…

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the public-only restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

PT-2026-134884

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-119625: Gitea: The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

EUVD-2026-112184

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...