EUVD-2026-41603

Gitea: Notification API leaks private issue metadata after access revocation...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the Notification API after access revocation. An attacker can obtain unauthorized access to private issue metadata by querying the API after their access has been revoked. Remediation Upgrade...

ROS-20260129-73-0053

A vulnerability in the Notification interface of Mozilla Firefox, Firefox ESR and Thunderbird email client is related to an operation exceeding buffer boundaries in memory when processing DOM objects. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his...

CVE-2026-20800

Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications...

SeaMonkey Code Execution

The SeaMonkey software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an unauthorized attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a special ICC profile...

SeaMonkey Code Execution

The SeaMonkey software contains a vulnerability in the nsJSThunk::EvaluateScript function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by manipulating the web notification API component...

Thunderbird RCE

Mozilla Thunderbird’s software contains a vulnerability in the qcmsprofilefrommemory function. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by manipulating the web notification API component, thereby creating a special ICC profile...