GHSA-Q9PG-JJ6X-J9P6 Gitea: draft release attachment disclosure via missing web authorization

Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ServeAttachment process. An attacker can access confidential draft release attachments by obtaining the UUID of the attachment through side channels such as API responses, browser history, log files, or shar...

Gitea: draft release attachment disclosure via missing web authorization

Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...

CVE-2026-47399

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

SUSE CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

SUSE CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

PT-2026-63299

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authorization bypass exists in the web-level attachment endpoints where access control for draft releases is not enforced. While the API endpoints correctly restrict draft release access to...

Linux Distros Unpatched Vulnerability : CVE-2026-64081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications car...

CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-64081

CVE-2026-64081 concerns the Linux kernel firmware path (arm_ffa) and fixes how framework notifications in the shared RX buffer are validated. The issue arose from indirect messages where an incorrect offset/size could enable misinterpretation of payloads. The fix validates the reported offset and...

CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

EUVD-2026-45654

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

CVE-2026-63892 thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

CVE-2026-63892

CVE-2026-63892 affects the Linux kernel thunderbolt property parsing. The non-root path in __tb_property_parse_dir() may read beyond the end of a property block when entry-&gt;length length and the code copies 4 dwords from dir_offset regardless of dir_len. This creates two OOB conditions: (1) a ...

PT-2026-61398

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm ffa firmware component where framework notification messages in the shared RX buffer are not properly validated. Specifically, the system fails to verify the...

maganghub-cors-poc

CORS PoC - MagangHub Proof of Concept f...

Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

Malicious code in cktool-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ee2228fd4f97fcc261019bf662b6e3006a5aed7a6f3bc0ec4fa505a84aa037 cktool-core is the unscoped public-registry form of the private-scoped @apple/cktool.core package. Installers whose resolver misroutes the scoped nam...