🚨 CVE-2026-55402
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.
🎖@cveNotify
CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.
🎖@cveNotify
Absolute
CVE-2026-55402 | Absolute Security
A high severity vulnerability in the Secure Access server installer prior to 14.57
🚨 CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
🎖@cveNotify
🚨 CVE-2026-55984
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
🎖@cveNotify
🚨 CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
🎖@cveNotify
🚨 CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
🎖@cveNotify
🚨 CVE-2026-56755
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
🎖@cveNotify
🚨 CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
Cross-repository issue/comment attachment re-linking can expose private attachment content
🎖@cveNotify
🚨 CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
🎖@cveNotify
🚨 CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
🎖@cveNotify
🚨 CVE-2026-58425
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
🎖@cveNotify
🚨 CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
🎖@cveNotify
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
🎖@cveNotify
🚨 CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
🎖@cveNotify
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
🎖@cveNotify
🚨 CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
🎖@cveNotify
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
🎖@cveNotify