Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 23:18:06 +0000 fkie_cve-2026-117649 https://db.gcve.eu/vuln/fkie_cve-2026-117649 <p>The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not &#34;dependency added&#34; and &#34;dependency removed&#34; events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue&#39;s current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.</p> <p>The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not &#34;dependency added&#34; and &#34;dependency removed&#34; events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue&#39;s current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-117649