CVE-2026-20909

Gitea versions before 1.25.5 are vulnerable to an Access Control Bypass due to insufficient permission checks when listing tracked time entries. An attacker can access private time tracking information without proper authorization by sending crafted requests to the tracked-time list endpoint. Thi...

CVE-2026-20779 Gitea TOTP single-use enforcement defect allows OTP replay

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path...

CVE-2026-20909 Gitea tracked-time list endpoint has insufficient permission checks

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

EUVD-2026-41615

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

CVE-2026-20909 Gitea tracked-time list endpoint has insufficient permission checks

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

CVE-2026-20779 Gitea TOTP single-use enforcement defect allows OTP replay

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path...

CVE-2026-46464

creationtimestamp| type| source ---|---|--- 2026-07-03 17:51:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr4dxghxb2z 2026-07-04 06:38:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpsh6gpyes2n...

CVE-2026-59234

creationtimestamp| type| source ---|---|--- 2026-07-03 14:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqrpeabqu2l 2026-07-04 04:11:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mps6yxxuv723...

Chromium: CVE-2026-14015 Inappropriate implementation in WebRTC

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Microsoft Edge for Android Remote Code Execution Vulnerability

Time-of-check time-of-use toctou race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network...

CVE-2026-56369

creationtimestamp| type| source ---|---|--- 2026-07-03 11:25:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqgrdc3lt2n...

CVE-2026-35159

creationtimestamp| type| source ---|---|--- 2026-07-03 10:50:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqethfskr2w 2026-07-03 22:57:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mprnhjkfvn2f 2026-07-03 23:48:46+00:00| seen|...

Exploit for CVE-2026-11387

CVE-2026-11387 — SMS Alert = 3.9.5 ☆ Unauthenticated Privilege...

CVE-2026-9180

creationtimestamp| type| source ---|---|--- 2026-07-03 06:05:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppuv4hsmw2l 2026-07-03 20:51:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mprgfdtgfl2c...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

badguythehacker

BountyAgent An autonomous AI-powered bug bounty platform. Spa...

SUSE CVE-2026-53326

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't call fillpool in early boot hardirq context When booting a debug PREEMPTRT kernel on an ARM64 system, a "inconsistent HARDIRQ-ON-W - IN-HARDIRQ-W usage" lockdep warning message was reported to the console...

SUSE CVE-2026-53327

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fillpool if piblockedon On RT enabled kernels, fillpool ends up calling rtlocklock, which asserts if current::piblockedon is set, because a task can obviously only block on one lock as otherwise the priority...

PT-2026-55595

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time...