CVE-2026-105267 Gitea tag delete route deletes releases without release permission

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

CVE-2026-105267

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

CVE-2026-105267 Gitea tag delete route deletes releases without release permission

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

EUVD-2026-94063

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

CVE-2026-105267 Gitea tag delete route deletes releases without release permission

The Gitea web route for deleting tags POST /owner/repo/tags/delete requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently...

CVE-2026-105267

The Gitea web route for deleting tags "POST /owner/repo/tags/delete" requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanent...

CVE-2026-105267

The Gitea web route for deleting tags (POST /{owner}/{repo}/tags/delete) contains a flaw where it shares request handling logic with release deletion without verifying if the target is a plain tag. This allows an authenticated collaborator with Code write permissions (but lacking Releases write a...

CVE-2026-106492

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with "security IMPORTLOCALPATHS = true", a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions...

CVE-2026-79814

An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute...

CVE-2026-103504

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-101154

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository...

CVE-2026-101155

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository...

CVE-2026-105840

A flaw was found in lrzsz. The lrz receive utility fails to properly sanitize absolute file paths in restricted mode, only checking for relative path traversal sequences. A remote attacker transmitting files can exploit this vulnerability to write or overwrite arbitrary files outside the intended...

CVE-2026-101258

A vulnerability exists in Ghostscript where rendering a crafted PostScript or EPS document allows an attacker to bypass the -dSAFER sandbox. The root cause is a chain of memory corruption during document parsing combined with the runtime disabling of internal path access controls. This allows for...

CVE-2026-101155

An authenticated remote attacker with specific permissions can perform a Path Traversal (CWE-22) attack on the Software Management Studio Software Repository . By using specially crafted requests or file uploads, the attacker can read or write files on the platform filesystem beyond the intended ...