DEBIAN-CVE-2026-14355

In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without...

CVE-2026-58419

The Gitea Notification API contains an information disclosure vulnerability where private issue or pull request metadata is leaked to users after their repository access has been revoked. While the repository field is correctly nulled out, the subject field remains accessible, exposing private ti...

CVE-2026-58419 Notification API leaks private issue metadata after access revocation

Notification API leaks private issue metadata after access revocation...

CVE-2026-58419 Notification API leaks private issue metadata after access revocation

Notification API leaks private issue metadata after access revocation...

CVE-2026-58419

Notification API leaks private issue metadata after access revocation...

CVE-2026-58419 Notification API leaks private issue metadata after access revocation

Notification API leaks private issue metadata after access revocation...

CVE-2026-27783

CVE-2026-27783 affects Gitea versions up to 1.26.1. The vulnerability arises because the issue_templates, issue_config, and issue_config/validate endpoints do not enforce repository-unit authorization, allowing callers with any repository unit (e.g., Issues) to read Code-tree files from the repos...

CVE-2026-27783 Gitea issue-template APIs bypass repository unit authorization

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...

EUVD-2026-41639

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...

CVE-2026-27783 Gitea issue-template APIs bypass repository unit authorization

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...

CVE-2026-27783

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...

CVE-2026-27783 Gitea issue-template APIs bypass repository unit authorization

Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints...

CVE-2026-26231

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write...

CVE-2026-25782 Gitea tracked-time deletion can target entries from another issue

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

CVE-2026-25782 Gitea tracked-time deletion can target entries from another issue

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

CVE-2026-25782

Gitea versions before 1.25.5 are vulnerable to an authorization bypass during the tracked-time deletion process. The root cause is that the application looks up tracked-time entries by time ID without scoping the lookup to the specific issue provided in the request URL. This allows an attacker to...

MINI-966V-W737-J2J6

Bulletin has no description...

EUVD-2026-41561

A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The attack can be initiated remotely. The...

CVE-2026-49813

creationtimestamp| type| source ---|---|--- 2026-07-03 18:04:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr52pnill2n 2026-07-04 08:56:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpsovz5k4o2c...

Chromium: CVE-2026-14019 Inappropriate implementation in Passwords

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...