CVE-2026-119627

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the "public-only" restriction of the personal access token used to authenticate. Any user holding a public-only token could send it...

CVE-2026-119625

The "/username" web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as "read:issue", could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other...

CVE-2026-119533

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull...

CVE-2026-119441

"DELETE /api/v1/orgs/org/repos" deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently...

CVE-2026-118504

The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels a...

CVE-2026-118395

Gitea 1.27.3 stopped personal access tokens restricted to public resources "public-only" from creating repositories through "POST /api/v1/user/repos" and "POST /api/v1/repos/migrate", but "POST /api/v1/org/org/repos", "POST /api/v1/orgs/org/repos", "POST /api/v1/orgs" and "POST...

CVE-2026-118394

The OAuth2 userinfo endpoint "/login/oauth/userinfo" decided whether to limit the "groups" claim to public organizations by re-parsing the "Authorization" header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token...

CVE-2026-117685

The OCI registry's cross-repository blob mount checked the target package against the token's "public-only" restriction, but checked the source blob only against the full account permissions of the token owner. A "public-only" token with "write:package" scope, whose owner can read a private packa...

CVE-2026-117677

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for "Chart.yaml" without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

CVE-2026-117649

The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for examp...

CVE-2026-117646

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources "public-only". A holder of such ...

CVE-2026-117635

The "/api/v1/admin" route group did not enforce the "public-only" restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner...

CVE-2026-116474

The "GITEATOKEN" of a Gitea Actions job authenticates as the "gitea-actions" system user, and the "/api/v1/user" email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation the default the address is stored as...

CVE-2026-116296

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download...

CVE-2026-116289

Gitea did not reject personal access tokens restricted to public resources "public-only" on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with "write:organization"...

CVE-2026-114199

"GET /api/v1/users/username/heatmap" computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their...

CVE-2026-113429

Legacy v1 to v3 Actions artifact uploads stored the request's "Content-Encoding" header unchecked in the column that is served as the artifact's "Content-Type" on download, and a value starting with "video/" or "audio/" also removed the sandboxing Content-Security-Policy. A user who can run an...

CVE-2026-112887

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could...

CVE-2026-120263

When "oauth2client.ACCOUNTLINKING" is set to "auto" not the default and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an accoun...

CVE-2026-118386

Workflows triggered by a pull request review were read from the commit named in the review's "commitid", while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a comm...

CVE-2026-120218

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publishe...

CVE-2026-120217

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried...

CVE-2026-120192

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120191

A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be...

CVE-2026-120252

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decodejpegsof3. Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overflowing the 32-entry HufVal and HufSz stack...

CVE-2026-120251

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccittfax4decodesize that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB to ccittfax4decode or the numcodecs Ccittfax...

CVE-2026-120250

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/emailutils.py and utils/emaildebug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP...

CVE-2026-120249

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrato...

CVE-2026-120247

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy data ends early, causing decodeslice t...

CVE-2026-120248

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logofile or bannerfile images. Attackers can upload an SVG with an onload payload served from...

CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

CVE-2026-120245

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrastdecodeframe that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. Attackers can craft a truncated Sun Raster file so the uncleared temporary bitmap is expanded into PAL8...

CVE-2026-120244

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to leak heap memory through truncated RLE scanlines. Attackers can craft a PCX image whose RLE data ends early, causing pcxdecodeframe to copy uninitialized avmalloc buffer...

CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

CVE-2026-120190

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cro...

CVE-2026-120185

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated...

CVE-2026-120135

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-118636

UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to...

CVE-2026-120210

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence...

CVE-2026-120209

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...

CVE-2026-120208

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-b...

CVE-2026-120206

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and...

CVE-2026-120207

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating t...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related...

CVE-2026-120204

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the outputdir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files ...

CVE-2026-120203

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval, then trigger...

CVE-2026-120202

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collectbundlesiblings and walkbundlesubdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc und...

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-120200

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints ...

CVE-2026-120199

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another userid to the submissions grade endpoint or query submission read functions to view other students...