GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

CVE-2026-33619

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to "POST /tasks" with a user-controlled "callbackUrl", the v0.8....