Total
4802 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-109374 | 2026-10-13 | N/A | 5.5 MEDIUM | ||
| ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAM_OWNER by bypassing the admin.impersonation check. Attackers holding IAM_END_USER_IMPERSONATOR or ORG_END_USER_IMPERSONATOR roles can sign in to relying applications as administrators with their roles and claims. | |||||
| CVE-2026-86684 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 7.1 HIGH |
| The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process. | |||||
| CVE-2026-89182 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.4 MEDIUM |
| With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected. | |||||
| CVE-2026-97208 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.9 MEDIUM |
| The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule. | |||||
| CVE-2026-81535 | 1 Wolfssh | 1 Wolfssh | 2026-10-13 | N/A | 9.1 CRITICAL |
| In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward. | |||||
| CVE-2026-90460 | 2026-10-13 | N/A | N/A | ||
| An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected. | |||||
| CVE-2026-79960 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 7.1 HIGH |
| When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner. | |||||
| CVE-2026-94205 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 9.8 CRITICAL |
| Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval. | |||||
| CVE-2026-96589 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved. | |||||
| CVE-2026-106381 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-13 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106297 | 1 Google | 1 Chrome | 2026-10-13 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-105267 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 8.1 HIGH |
| The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion. | |||||
| CVE-2026-105268 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete attachments that other users had posted in comments on that issue. The contents of the attachments could not be changed. | |||||
| CVE-2026-6723 | 2026-10-13 | N/A | 5.3 MEDIUM | ||
| The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type. | |||||
| CVE-2025-13324 | 1 Mattermost | 1 Mattermost Server | 2026-10-13 | N/A | 3.7 LOW |
| Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed. | |||||
| CVE-2025-53922 | 1 Galette | 1 Galette | 2026-10-13 | N/A | 4.9 MEDIUM |
| Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue. | |||||
| CVE-2025-58052 | 1 Galette | 1 Galette | 2026-10-13 | N/A | 8.1 HIGH |
| Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue. | |||||
| CVE-2025-68940 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 3.1 LOW |
| In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request. | |||||
| CVE-2025-68941 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.9 MEDIUM |
| Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources. | |||||
| CVE-2025-68938 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 4.3 MEDIUM |
| Gitea before 1.25.2 mishandles authorization for deletion of releases. | |||||