406,158 results · Feed
-
Medium 4.3
Gitea limited-visibility profile disclosure with public-only tokens
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user hol…
-
Medium 4.3
Gitea user and organization feed token scope bypass
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and t…
-
High 7.5
Gitea private pull request disclosure on project boards
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the …
-
High 7.5
Gitea public-only token bypass on bulk organization repository deletion
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public org…
-
Medium 6.5
Gitea issue changes on archived repositories through the API
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, c…
-
High 7.5
Gitea public-only token bypass in repository and organization creation
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POS…
-
Medium 4.3
Gitea OAuth2 userinfo private group disclosure to public-only tokens
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the r…
-
Critical 9.1
Gitea public-only package token access to private OCI blobs
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope…
-
Medium 6.5
Gitea Helm chart upload decompression denial of service
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed u…
-
Low 3.5
Gitea private issue disclosure through issue dependency timeline events
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a reposito…
-
Medium 4.3
Gitea private repository listing to public-only tokens on profiles
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public reso…
-
Medium 6.5CVE-2026-117635 Public exploit
Gitea admin API public-only token scope bypass
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, creat…
-
Medium 6.5
Gitea Actions job token spoofing of instance-signed commits
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation…
-
Medium 6.5CVE-2026-116296 Public exploit
Gitea archived repository release, milestone and label modification
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release…
-
Critical 9.1
Gitea public-only token bypass through Actions runner registration
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only …
-
Medium 5.3
Gitea contribution heatmap private activity disclosure to public-only tokens
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token coul…
-
Medium 5.4
Gitea stored XSS through legacy Actions artifact Content-Encoding
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-S…
-
Medium 4.3
Gitea Actions task token private repository enumeration
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped route…
-
Critical 9.8
Gitea OAuth2 account auto-linking takeover through the sign-up form
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the…
-
Medium 6.5
Gitea Actions fork workflow trust through pull request review commit
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read ac…
-
Low 3.5CVE-2026-120218 Public exploit
Typemill SvgSanitizer.php saveImage cross site scripting
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from…
-
Medium 4.3
Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexit…
-
Medium 5.3
MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
-
Medium 4.3
Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber …
-
Medium 4.3
Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, …
-
Medium 4.3
Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assi…
-
Medium 6.8
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
-
Critical 10.0
WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to launch the attack rem…
-
Critical 9.9
WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has …
-
Critical 9.9
WAVLINK WN579X3-D wapi.cgi port_forward os command injection
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now…
-
Critical 10.0
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlan_ssid leads to o…
-
Medium 5.3
Presenton Desktop Authentication Middleware app_data information disclosure
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the a…
-
High 7.3
Presenton API missing authentication
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been mad…
-
Medium 5.5
imagecodecs 2023.1.23 through 2026.10.10 Stack Buffer Overflow via jpegsof3_decode()
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). Attackers can supply a crafted lossless JPEG whose DHT symbol counts wrap an 8-bit sum, overfl…
-
Medium 5.5
imagecodecs 2026.3.6 through 2026.10.10 Infinite Loop via ccittfax4_decode()
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 stream lacking EOFB t…
-
Medium 5.3
OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a fo…
-
Medium 6.5
Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attac…
-
Medium 5.5
FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …
-
Medium 4.8
Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an …
-
Medium 5.5
FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palet…