Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

Exposure of Private Personal Information to an Unauthorized Actor

Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...

EUVD-2026-41621

Gitea: Unauthorized Access to Labels of Private Organizations...

CVE-2026-63927

A flaw was found in the Linux kernel, specifically within the dwc2 USB driver. This vulnerability, known as a use-after-free, occurs when the system attempts to access memory that has already been released. This happens because a USB Request Block urb is incorrectly accessed after it has been...

CVE-2026-62530

Vulnerability in the Oracle HRMS France product of Oracle E-Business Suite component: French HR. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS France. Successful attac...

CVE-2026-62528

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Install. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Configurati...

CVE-2026-62473

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

CVE-2026-47053

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

CVE-2026-63141

This CVE (CVE-2026-63141) concerns Missing Authorization (CWE-862) in Kibana’s Cloud Connect feature. An authenticated user can access and modify Cloud Connect configuration and service settings via insufficiently protected endpoints. Affected versions include Kibana 9.3.x (9.3.0–9.3.7) and 9.4.x...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

CVE-2026-47697

Shelf is a multi-tenant platform for tracking physical assets. Prior to version 1.20.2, several endpoints accepted entity IDs from input and connected/read/updated them without verifying ownership, enabling cross-tenant IDOR where an authenticated user in Org A could access Org B’s data (assets, ...

CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

GHSA-7WVC-RVP7-W99X Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

GHSA-VXV2-8J6R-PCPG Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the CheckAuthToken function. An attacker can maintain unauthorized, persistent access to a user's account by reusing a stolen Remember-Me token, as the compromised session is not invalidated even after...