9788 matches found
CVE-2026-96404
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
EUVD-2026-93923
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404
When Gitea's web installer is reachable against a database that already contains users, such as after "INSTALLLOCK" has been reset to "false", submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying...
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
CVE-2026-96404
A flaw in Gitea allows an unauthenticated remote attacker to bypass authentication via the web installer. If the installer is reachable against a database already containing users (e.g., after INSTALL_LOCK is set to false), an attacker can submit the installation form using an existing administra...
CVE-2026-96404
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
PT-2026-107225
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When the web installer is accessible and connected to a database that already contains users, such as when the INSTALL LOCK variable is set to false, the system may issue an authenticated sessi...
CVE-2026-96404: Improper Authentication
When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...
Malicious code in request-guard (RubyGems)
RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
MAL-2026-17569 Malicious code in request-guard (RubyGems)
RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
Malicious code in rate-limit-mini (RubyGems)
RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
CLEANSTART-2024-LU48204 Insufficient policy enforcement in Installer in Google Chrome prior to 92
Security vulnerability affects the chromium package. Insufficient policy enforcement in Installer in Google Chrome prior to 92...
CVE-2026-80275
Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...
CVE-2026-80275 Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...
CVE-2026-80275 Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...
CVE-2026-80275
The Comelit Multi-User Gateway for VIP System (model 1456B) is vulnerable in firmware versions 2.9.1 and 2.10.0 due to a failure to enforce server-side authorization on an administrative password-change function. This flaw allows an authenticated user level to invoke the function and overwrite th...
CVE-2026-80275: Direct Request
Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...
PT-2026-103697
Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...