38,661 results · Feed
-
Medium 5.1
rails-html-sanitizer: Possible XSS vulnerability with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also ac…
-
Medium 5.3
@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMe…
-
High —
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in: - Autho…
-
Low 2.3
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semico…
-
Medium 4.7
Loofah: SVG `href` attribute bypasses local-reference restriction
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage…
-
Medium 6.5
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrap…
-
Medium 5.7
TypeORM: migration:generate template-literal code injection
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or…
-
High 8.7
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into …
-
High 7.1
Gitea TOTP single-use enforcement defect allows OTP replay
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.
-
Medium 4.9
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
-
High 7.6
Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a cus…
-
Low 2.7
Webhook Authorization Header Returned in Plaintext via API
Webhook Authorization Header Returned in Plaintext via API
-
Medium 6.5
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
-
Medium 4.3
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
-
Medium 4.3
Public-only API token restriction is not enforced on team API routes
Public-only API token restriction is not enforced on team API routes
-
High 7.5
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
-
Critical 9.8
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
-
High 7.5
Notification API leaks private issue metadata after access revocation
Notification API leaks private issue metadata after access revocation
-
High 7.5
Gitea private organization labels are visible to unauthorized users
Gitea 1.26.2 allows unauthorized users to access labels of private organizations.
-
High 8.8
Gitea pre-receive hook permission cache allows full repository write access
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.
-
High 7.5
Gitea fork synchronization can expose private parent repository data
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.
-
Medium 5.1
Capstone has a NULL Pointer Dereference with 3DNow! opcodes
Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote at…
-
High 7.7
Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2
-
High 7.5
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
-
Medium 6.2
Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
-
High 7.1
Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options
-
High 8.1
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
-
Medium 5.4
Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation
-
Medium 4.4
Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore
-
Low 2.7
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
-
Critical 9.1
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
-
High 7.5
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
-
High 7.5
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
-
High 7.5
REST API exposes organization membership of private organizations to public
REST API exposes organization membership of private organizations to public
-
Medium 4.3
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
-
High 7.1
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
-
Medium 6.5
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
-
Low 2.7
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
-
Medium 4.3
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
-
Critical 9.1
Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches