123707 matches found
K000162352: Lodash vulnerability CVE-2026-4800
Security Advisory Description Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Whe...
Security Bulletin: Multiple vulnerabilities in IBM Controller
Summary Multiple vulnerabilities were addressed in IBM Controller. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName...
Exploit for Stack-based Buffer Overflow in Microsoft
CVE-2026-41089-Netlogon-RCE Technical analysis and Proof-of-Co...
PT-2026-62205
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise JDBC. Successf...
PT-2026-63311
| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...
PT-2026-63299
Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...
PT-2026-63277
Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...
PT-2026-63278
Summary Gitea's internal API HTTP client modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true with no configuration override. It is the only outbound TLS client in the codebase that cannot be made to verify its peer's certificate — webhook, migrations, MinIO, LDAP, SMTP...
PT-2026-63281
Description Gitea's OAuth2 sign-in callback reactivates a deactivated user account IsActive=false when the user signs in through an authentication source that does not issue refresh tokens notably GitHub, and any OIDC/OAuth2 source configured without offline access. PR 38009 added a gate intended...
PT-2026-63289
Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...
PT-2026-63310
Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...
PT-2026-63312
Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repo model.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...
PT-2026-63301
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...
PT-2026-62053
Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph walk cell and sph alloc slot. The attach-time validator sph validate header checks the header scalars and region layout against the file size, but...
PT-2026-62044
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...
PT-2026-62199
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise RDBMS...
PT-2026-63314
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
📄 WordPress JSON API User 3.9.2 Unauthenticated Privilege Escalation
WordPress JSON API User plugin version 3.9.2 contains an unauthenticated privilege escalation to administrator vulnerability through Mass-Assignment. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrate...
📄 WordPress WooCommerce Simple Registration 1.5.6 Unauthenticated Privilege Escalation
WordPress WooCommerce Simple Registration plugin version 1.5.6 contains an unauthenticated privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit demonstrates the...
📄 WordPress Enable SVG, WebP and ICO Upload 1.1.2 Shell Upload
WordPress Enable SVG, WebP and ICO Upload plugin version 1.1.2 contains an authenticated Author+ arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the...