GHSA-9R5X-WG6M-X2RC Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication

Summary Gitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only read:user can use the same token as Authorization: Basic base64:x-oauth-basic and perform write actions, including...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56317 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56317 Source advisory: SNYK:JS-NUXT-17353899...

CVE-2026-22312

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogoyat2ju2a 2026-06-16 21:43:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogreeehlr2g...

CVE-2026-35288

creationtimestamp| type| source ---|---|--- 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1923 2026-06-17 05:31:59+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-8 2026-06-17 09:09:05+00:00| seen|...

GHSA-JP82-JPQV-5VV3 vulnerabilities

Vulnerabilities for packages: nemo, airflow-postgres-fips, semgrep, tritonserver-backend-vllm-cuda-13.0, litellm, mlflow-fips, mlflow, kserve, prefect-fips, prefect, tritonserver-backend-vllm-cuda-12.9, airflow, airflow-core...

GHSA-63HW-FMQ6-XXG2 vulnerabilities

Vulnerabilities for packages: authentik-fips, text-generation-inference, apache-beam-python-3.13-sdk, authentik, metaflow-service-fips, py3-vllm-cuda-13.0, mlflow-fips, request-1276, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, apache-beam-python-3.11-sdk,...

GHSA-XCGM-R5H9-7989 vulnerabilities

Vulnerabilities for packages: authentik-fips, text-generation-inference, apache-beam-python-3.13-sdk, authentik, metaflow-service-fips, py3-vllm-cuda-13.0, mlflow-fips, request-1276, tritonserver-backend-vllm-cuda-12.9, tritonserver-backend-vllm-cuda-13.0, apache-beam-python-3.11-sdk,...

CVE-2026-53866

creationtimestamp| type| source ---|---|--- 2026-06-16 20:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moglm7xyvh2t 2026-06-16 21:28:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogqkrsawf2x...

CVE-2026-46974

...

CVE-2026-46976

Technical details are not publicly available in the provided documents for CVE-2026-46976. Monitor for updates from Oracle security alerts and CVE records.

CVE-2026-46973

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-46973

...

CVE-2026-46972

...

CVE-2026-46969

Technical details for CVE-2026-46969 are not publicly available in the provided documents. No affected products, vulnerable components, root cause, or remediation are specified. Monitor for updates from official sources.

CVE-2026-46967

...

CVE-2026-46964

Technical details about CVE-2026-46964 are not publicly available in the provided documents. Monitor for updates from the sources; no product/vendor/impact/fix details are included here.

CVE-2026-46964

...

CVE-2026-46963

Technical details for CVE-2026-46963 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-46961

...

CVE-2026-46961

Technical details are not publicly available in the provided documents. Monitor for updates from Oracle and CVE feeds.