1733 matches found
Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure
Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken middleware, exposing team IDs, names, descriptions,...
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...
CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...
CVE-2026-72846
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...
CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...
CVE-2026-65768
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...
CVE-2026-65769
Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network...
CVE-2026-65767
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...
CVE-2026-65767
Microsoft Teams for Android is affected by CVE-2026-65767 due to improper neutralization of input during web page generation (XSS). Attack requires network access with low privileges and no user interaction; an authorized attacker could spoof content. The CVSS v3.1 base score is 8.8 (HIGH). Affec...
CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
...
EUVD-2026-56774
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network...
CVE-2026-65767 Microsoft Teams for Android Spoofing Vulnerability
...
CVE-2026-65769
CVE-2026-65769 affects Microsoft Teams Mobile (iOS). It is described as an information disclosure vulnerability where an unauthenticated network attacker could access sensitive data disclosed by the app. The available sources (NVD/MSRC) confirm exposure over a network but do not provide detailed ...
CVE-2026-65769 Microsoft Teams iOS Information Disclosure Vulnerability
...
EUVD-2026-56565
Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network...
CVE-2026-65769 Microsoft Teams iOS Information Disclosure Vulnerability
...
CVE-2026-65768
CVE-2026-65768 is a Microsoft Teams for Android path traversal leading to remote code execution over a network. The root cause is an improper limitation of a pathname to a restricted directory, enabling an unauthenticated, network-based attacker to run code. Public CVSS data assigns a high/critic...
EUVD-2026-56290
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...