CVE Vulnerability Catalog

A vulnerability in Gitea before version 1.25.5 allows draft release data or attachments to be accessed without the required write permission.

A vulnerability in Gitea before version 1.25.5 allows a user to change another user's primary email address. The issue stems from insufficient permission validation during account modification.

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

A vulnerability in Gitea up to version 1.26.1 allows users with the 'Allow edits from maintainers' permission to commit changes to repositories they have read-only access to but should not be able to write.

In Gitea versions before 1.25.5, insufficient visibility checks in organization permission APIs allow disclosure of hidden members and private organizations.

In Gitea 1.26.2, unauthorized users can access labels of private organizations. This vulnerability allows information disclosure of labels that should be restricted to organization members.

In Gitea versions before 1.25.5, there is a vulnerability due to insufficient permission checks when updating or rebasing pull request branches.

A vulnerability in Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, leading to unauthorized data exposure.

A vulnerability in Gitea before version 1.26.0 allows API users to fork a repository into an organization without passing the CanCreateOrgRepo check, potentially exposing organization secrets.

A vulnerability in Gitea versions 1.5.0 through 1.26.2 allows a valid TOTP code to be reused multiple times during two-factor authentication via web flows and Basic Auth with the X-Gitea-OTP header.

A security flaw in RT-Thread up to version 5.0.2 affects the CAN_Receive function in the SWM341.h file of the SWM341 CAN Handler component. A local attacker can trigger a stack-based buffer overflow through data manipulation. A public exploit is available for attacks.

A stack-based buffer overflow vulnerability was found in RT-Thread up to version 5.0.2 in the ls1c CAN Handler component's recvmsg function. The attack requires local access and the exploit is publicly available.

A heap buffer overflow vulnerability was found in GIMP's Paint Shop Pro (PSP) file format parser. The flaw occurs due to incorrect buffer size calculations when processing low bit-depth images, allowing a remote attacker to execute arbitrary code or cause a denial of service (DoS) by tricking a user into opening a specially crafted PSP file.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high-privileged attacker with remote access could exploit this flaw to execute arbitrary OS commands.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high-privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

Missing authorization in TUBITAK BILGEM's pardus-software allows argument injection. The vulnerability affects versions 1.0.4 and earlier, before version 1.0.5.

An argument injection vulnerability in TUBITAK BILGEM's pardus-software allows attackers to inject additional arguments into commands. The issue affects versions up to 1.0.4 and is fixed in version 1.0.5.

A vulnerability in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0 allows a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC endpoint accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses.