216 matches found
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
EUVD-2026-62933
In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before...
EUVD-2026-60025
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
CVE-2026-50601
CVE-2026-50601 affects the Planet9 desktop application, where a hardcoded read-only API key allows unauthorized access to internal repositories. An attacker could use this access to extract embedded administrative keys and secrets, potentially gaining administrative control over repository infras...
CVE-2026-50601 Planet9 Hardcoded Credentials Vulnerability Information
A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation...
PT-2026-71103
Name of the Vulnerable Software and Affected Versions Puppet affected versions not specified Description An authenticated user can view private Puppet module metadata even if they do not have the required repository read access. Recommendations At the moment, there is no information about a newer...
CVE-2026-72770 n8n before 1.123.67 Path Traversal via Git Node Operations
n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...
SUSE CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation...
SUSE SLED15 / SLES15 Security Update : apache-sshd (SUSE-SU-2026:3339-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3339-1 advisory. Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send...
CVE-2026-66018
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
CVE-2026-65922
Technical details for CVE-2026-65922 are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-65922 Potential unauthorized modification of Artifactory internal metadata
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
CVE-2026-66018 JFrog Artifactory build environment properties exposure
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
CVE-2026-66018
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
EUVD-2026-49573
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
CVE-2026-66018
CVE-2026-66018 affects JFrog Artifactory: Build readers can access another repository's environment properties by selecting a readable repository parameter when retrieving environment properties for a protected build, exposing build environment secrets. Impact is confidentiality only (no integrit...
PT-2026-65110
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is...
PT-2026-65116
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets confidentiality impact; no integri...
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...