431369 matches found
CVE-2026-129525
The Gitea platform is affected by a vulnerability where certain API endpoints and web pages failed to verify whether an addressed item was an issue or a pull request. This allowed users with permission to read issues but not pull requests (or vice versa) to access pull request data via issue sub-...
CVE-2026-129341
In Gitea , a vulnerability exists where the web endpoint for removing attachments skips permission checks if the request originates from the original uploader. This allows a user who previously uploaded a release asset to delete it even after losing write access to the repository. The endpoint is...
CVE-2026-129337
The Gitea platform is vulnerable to an unauthorized push because Git over HTTP lowers the required permission for pushes to read access, relying on server-side hooks for enforcement. During a migration, fork, or template generation , there is a window where the repository lacks these hooks. A use...
CVE-2026-128365
The Gitea platform is affected by a logic flaw where removing a team's review request for a pull request could incorrectly mark an old review as official. Specifically, removing a request for the team with ID 2 caused the system to look up reviews by the Actions user ID, potentially allowing an a...
CVE-2026-128359
When Gitea acts as an OAuth2 or OpenID Connect provider, a vulnerability exists because the token endpoint fails to verify a user's account status. This allows accounts that have been deactivated or prohibited from signing in by an administrator to still exchange existing refresh tokens and unuse...
CVE-2026-127958
The software Gitea is vulnerable to an information disclosure issue where pull request reviews created via the API as drafts (with the event set to PENDING or left empty) were incorrectly added to the pull request timeline. This caused the review's body and line comments to be visible to anyone w...
CVE-2026-126338
In Gitea , a vulnerability allows for private diff disclosure through code review comment replies. A signed-in user can exploit this by replying to a comment on a pull request they can access while providing a review ID belonging to a different, inaccessible repository via the web form, API, or m...
CVE-2026-125617
In Gitea , a vulnerability exists in the permissions API endpoint GET /api/v1/users/{username}/orgs/{org}/permissions. The application only verified if the organization was visible to the caller before returning a specific user's role. This allowed any signed-in user to disclose whether another u...
CVE-2026-123642
The Gitea platform is vulnerable to unauthorized pull request creation due to a missing authorization check in the AGit flow (pushing to refs/for/...). Specifically, the system failed to re-verify the pusher's permissions during pull request creation. This allowed users, deploy keys, or SSH wiki ...
CVE-2026-123638
A vulnerability in Gitea allows users with write access to bypass Protected file patterns within branch protection rules. The root cause is that the system checked file names as git prints them; since git quotes names containing double quotes, backslashes, or control characters, these files faile...
CVE-2026-123065
The Gitea application is vulnerable to the deletion of arbitrary attachment files when editing a release. The root cause is an authorization bypass where the system deletes files based on submitted form identifiers rather than verifying if the attachments belong to the specific release. A user wi...
CVE-2026-123009
The Gitea platform is vulnerable to code disclosure via the web editor when editing files in a fork . The root cause is an improper access control flaw where the system failed to verify if a user retained read access to a base repository when copying branches into a fork. Consequently, users who ...
CVE-2026-123002
The Gitea platform was found to accept an unlimited number of wrong TOTP passcodes during sign-in, within the password reset flow, and for Basic authentication using the X-Gitea-OTP header. This vulnerability (CWE-307) allows an attacker who possesses an account's password to perform a brute-forc...
CVE-2026-120991
The Gitea platform is vulnerable to a flaw where rejected container blob uploads (e.g., due to exceeding size quotas) incorrectly trigger a cleanup process that deletes shared content. If a user uploads a blob with content identical to another user's package layer, the system removes the shared b...
CVE-2026-120729
The Gitea platform is vulnerable to a stored cross-site scripting (XSS) flaw in the issue reference popup. The vulnerability occurs because the popup loads data from the hovered link's path and inserts the response as HTML . An attacker capable of posting comments can provide a link pointing to a...
CVE-2026-120725
The Gitea platform contains a vulnerability where Git LFS endpoints fail to enforce authentication even when REQUIRE_SIGNIN_VIEW is set to true. For non-private repositories, an unauthenticated client knowing the repository path and the SHA-256 of an LFS object can download the object or use the ...
CVE-2026-118535
The Gitea platform is affected by a vulnerability where a repository registered as a source of scoped workflows retained its registration after being transferred to a new owner. This allowed the new owner to modify workflows that continued to execute in the original owner's repositories, potentia...
CVE-2026-118389
The RubyGems package registry is vulnerable to an injection attack because it accepted gems containing newline characters in the platform, dependency names, or version requirements. Since the compact index is line-based, an attacker capable of publishing a gem to a registry can forge index entrie...
CVE-2026-125423
The Gitea platform is vulnerable to command execution due to a race condition during repository auto-initialization . A user with repository creation permissions can push a crafted tree while initialization is incomplete, causing the system to follow a symbolic link and overwrite a server-side gi...
CVE-2026-123006
The Gitea repository search functionality via the GET /repo/search endpoint contains a vulnerability where it exposed internal commit status objects. Since version 28.0.0 , these objects included the repository owner's full user record. Consequently, any authenticated user could access the passwo...
CVE-2026-125796
The Ahmad JS Help Desk (js-support-ticket) WordPress plugin, specifically versions 5.0.5 and below , is affected by a Missing Authorization vulnerability. This flaw allows for the exploitation of Incorrectly Configured Access Control Security Levels . The vulnerability results in Broken Access Co...
CVE-2026-125760
The Bit Apps Bit Assist plugin for WordPress (versions n/a through 1.8.4 ) is vulnerable to a DOM-Based Cross-Site Scripting (XSS) flaw. This issue stems from the Improper Neutralization of Input During Web Page Generation , which could allow an attacker to execute malicious scripts in the contex...
CVE-2026-125826
The Blubrry Podcasting PowerPress Podcasting plugin (versions ≤ 11.18.3 ) is vulnerable to a Path Traversal vulnerability, which also enables Arbitrary File Deletion . This issue arises from an Improper Limitation of a Pathname to a Restricted Directory (CWE-22). While the specific root cause is ...
CVE-2026-125804
The Meow Apps AI Engine plugin for WordPress (versions 3.9.3 and below ) is vulnerable to Stored Cross-Site Scripting (XSS) due to the Improper Neutralization of Input During Web Page Generation . An attacker can exploit this flaw to inject and store malicious scripts, which then execute in the c...
CVE-2026-125823
The Jegstudio Gutenverse WordPress plugin (versions
CVE-2026-125830
The WordPress plugin belingoGeo (versions n/a through 1.13.3 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. This issue stems from the improper neutralization of input during web page generation , allowing an attacker to inject malicious scripts. No specific remediation o...
CVE-2026-125818
The wpDiscuz WordPress plugin (versions 7.6.75 and below ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This issue stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious scripts that are stored on the server and exec...
CVE-2026-125798
The Zaytech Smart Online Order for Clover WordPress plugin (versions
CVE-2026-129091
The Mikado-Themes GrandPrix Core plugin (versions
CVE-2026-125822
The Nickboss WordPress File Upload (wp-file-upload) plugin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions 5.2.3 and below . The root cause is the improper neutralization of input during web page generation. An attacker could potentially execute malicious scripts in the cont...
CVE-2026-125817
The Themeisle Feedzy feedzy-rss-feeds WordPress plugin (versions up to and including 5.2.15 ) is vulnerable to a Stored Cross-Site Scripting (XSS) issue. This vulnerability is caused by the Improper Neutralization of Input During Web Page Generation (CWE-79). While the specific function or file i...
CVE-2025-71466
GPAC versions prior to 26.02.0 are vulnerable to a NULL pointer dereference in the m2tsdmx_update_sdt() function located in src/filters/dmx_m2ts.c. An attacker can trigger a denial of service (DoS) by providing a crafted .ts file containing an invalid service descriptor with NULL service or provi...
CVE-2025-71467
Versions of GPAC prior to 26.02.0 are susceptible to a NULL pointer dereference vulnerability within the gf_node_get_field_by_name() function located in src/scenegraph/base_scenegraph.c. An attacker can trigger a denial of service by providing a crafted XMT scene that references a node that was n...
CVE-2025-71468
GPAC versions prior to 26.02.0 are susceptible to a NULL pointer dereference vulnerability within the gf_dash_group_get_audio_channels() function in src/media_tools/dash_client.c . An attacker can trigger this flaw by providing a crafted DASH manifest (MPD) where the AudioChannelConfiguration ele...
CVE-2025-71469
GPAC versions prior to 26.02.0 are susceptible to a type confusion vulnerability within the ctxload_process() function. The root cause is the failure to verify descriptor tags before passing non-object descriptors to ODS_SetupOD(). An attacker can trigger a denial of service (DoS) by providing a ...
CVE-2025-71470
MicroQuickJS (mquickjs ) versions prior to commit 99eed3f are susceptible to an out-of-bounds read vulnerability. The root cause occurs because the JS_Call() function raises exceptions during frame setup without correctly updating ctx->sp and ctx->fp . An attacker can provide JavaScript tha...
CVE-2026-129490
The littlefs file system, through version 2.11.3 , is vulnerable to a type confusion flaw in the lfs_dir_traverse() function when compiled with the LFS_MIGRATE flag. The root cause occurs when the system treats a stack-based lfs_diskoff struct as an lfs_attr array. An attacker can exploit this by...
CVE-2026-129484
The Kroki application before version 0.36.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of input validation for the svg-color-dark-scheme and svg-color-light-scheme options within the /goat/svg endpoint. An unauthenticated attacker can craft a...
CVE-2026-129485
Kroki versions prior to 0.36.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the BlockDiag engine family. Unauthenticated attackers can exploit node icon and background attributes by sending crafted diagrams to the POST /blockdiag/svg endpoint or related sibling endp...
CVE-2026-125795
The Estatik WordPress plugin (versions
CVE-2026-125765
The ShortPixel Adaptive Images WordPress plugin (versions 3.11.6 and below) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw arises from Improper Neutralization of Input During Web Page Generation , allowing an attacker to inject malicious scripts that are stored on the server and ex...
CVE-2026-125793
The flexmls Flexmls® IDX (flexmls-idx) WordPress plugin, versions 4.1.2 and earlier , is vulnerable to Reflected Cross-Site Scripting (XSS) . This issue stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to execute malicious scripts in a victim's...
CVE-2026-128893
The Marcin Wise Chat WordPress plugin (versions 3.4.5 and below ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability allows an attacker to execute arbitrary scripts in a user's browser. No specific ex...
CVE-2026-125799
The Flow-Flow Social Stream WordPress plugin (versions up to and including 5.0.5 ) is vulnerable to an Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538). This flaw allows an attacker to Retrieve Embedded Sensitive Data from the plugin. No specific technical...
CVE-2026-125447
The Kaliforms Kali Forms WordPress plugin (versions 2.4.31 and below ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could potentially execute malicious scripts in a user's browser. No specific...
CVE-2026-125771
The MCP Server for WordPress plugin (part of the ai-workflow-automation-ai-agent-hub by AtlasAiDev ) is vulnerable to a Privilege Escalation flaw (CWE-266) in versions 2.0.3 and earlier . This Incorrect Privilege Assignment vulnerability allows an attacker to escalate privileges within the affect...
CVE-2026-125733
The ShopLentor (woolentor-addons) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 3.5.7 . The root cause is the improper neutralization of input during web page generation (CWE-79), which allows an attacker to execute malicious scripts in a u...
CVE-2026-125780
The Acowebs Woocommerce Custom Product Addons Pro plugin (versions
CVE-2026-125449
The Mamunur Rashid Testimonial Slider (testimonial-slider-and-showcase) WordPress plugin is vulnerable to PHP Object Injection via the Deserialization of Untrusted Data (CWE-502). This vulnerability affects versions 3.0.2 and below . Successful exploitation can lead to Object Injection , potentia...