🚨 CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
🎖@cveNotify
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
🎖@cveNotify
Gitea
Gitea 1.25.5 is released | Gitea Blog
We're excited to announce the release of Gitea 1.25.5! We strongly recommend all users upgrade to this version, as it includes important security fixes, numerous bug fixes, and overall stability improvements.
🚨 CVE-2026-24791
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
🎖@cveNotify
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
🎖@cveNotify
Gitea
Gitea 1.26.2 is released | Gitea Blog
We are excited to announce the release of Gitea 1.26.2! We strongly recommend all users upgrade to this version, as it contains a number of security fixes alongside important bug fixes and stability improvements.
🚨 CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
🎖@cveNotify
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
🎖@cveNotify
🚨 CVE-2026-54481
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
🎖@cveNotify
🚨 CVE-2026-55402
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.
🎖@cveNotify
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.
🎖@cveNotify
Absolute
CVE-2026-55402 | Absolute Security
A high severity vulnerability in the Secure Access server installer prior to 14.57
🚨 CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
🚨 CVE-2026-55984
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
🚨 CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
🚨 CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
🚨 CVE-2026-56755
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
🚨 CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
🚨 CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
🚨 CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify