git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

Docusaurus Gists Plugin < 4.0.0 - GitHub Personal Access Token Exposure

The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuratio...

CVE-2026-86762

Snipe-IT before 8.7.0 is vulnerable to an authentication bypass via its API middleware. The CheckUserIsActivated middleware is not applied to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke existing Passport personal access tokens . A deactivated account t...

EUVD-2026-74932

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (/oauth/personal-access-tokens*) with only the web and auth:web middleware, lacking the self.api permission gate that Snipe-IT enforces on its own token endpoints. Any user with a valid we...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2022-1175

CVE-2022-1175 GitLab 存储型 XSS，可以在项目（无论是你自己的还是其他用户的）的 issue 中设置。可发起攻击，例如创建并窃取任何访问该 issue 用户的个人访问令牌（PAT）。获取 PAT 后，即可获得该用户完整的 GitLab API 访问权限，等同于完全接管账户。 可以通过将项目的 base 更改为你的站点来滥用此漏洞，从而使脚本从你的站点加载。更改你站点上的 JavaScript，使其与页面中调用的脚本名称匹配。不过这可能会破坏页面上的某些功能。 根据站点的 CSP 策略，标准脚本引入方式也可以生效。这种方式更加隐蔽。 GitLab...

CVE-2026-58108

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

EUVD-2026-63550

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444

CVE-2026-58444 covers a bypass of personal access token scope enforcement on the Gitea repository home page (GET /{owner}/{repo}), which can disclose private repository contents. Affected: Gitea (open-source Git hosting) with token scope checks on repository home pages; root cause: deficiencies i...

CVE-2026-58429

CVE-2026-58429 affects Gitea: Public-Only Personal Access Tokens scope bypass in Organization and Permission Endpoints. Public-PAT scope bypass indicates an access-control deficiency at the organization/permission boundary, enabling a token with restricted privileges to access operations that sho...

CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

UBUNTU-CVE-2026-64652

GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...

CVE-2026-64652

The CVE covers GitHub CLI (gh) prior to v2.97.0, where gh auth status could reveal part of certain tokens in output. Affected tokens include fine-grained PATs (github_pat_) and GitHub App tokens (ghs_ and ghu_*), plus the Actions GITHUB_TOKEN, whenever the token format contains an underscore afte...

GO-2026-6050 Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev

Gitea: Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents in gitea.dev...