https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 08:34:18 +0000 https://db.gcve.eu/vuln/cve-2026-114199 <p><strong>Affected:</strong> Gitea</p> <p>`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user&#39;s public-only token could read contribution counts and their 15-minute time buckets that stem from that user&#39;s activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.</p> <p><strong>Affected:</strong> Gitea</p> <p>`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user&#39;s public-only token could read contribution counts and their 15-minute time buckets that stem from that user&#39;s activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users.</p> https://db.gcve.eu/vuln/cve-2026-114199