CVE-2026-114199

A flaw was found in Gitea. An authenticated user possessing a restricted, public-only access token can trigger an information disclosure vulnerability by querying the user contribution heatmap API endpoint. Due to improper enforcement of token scope restrictions, the endpoint computes activity da...

CVE-2026-108727

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a templa...