Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/hexcraft-labs"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/d3do-23"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/takumi142857-git"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/N0K0"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/zzy13051013697"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/HexDump0"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/123abab123789"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/basavaraj-sm05"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who can read a repository\u0027s issues but not its pull requests could read pull request data through the issue sub-resources of the API (timeline, attachments, labels, subscriptions, tracked times and reactions), and list pull requests through the repository\u0027s issue search and milestone pages; the same applied in the other direction. These endpoints now check read access to the unit the item belongs to. The API endpoints were fixed in 28.2.0 and 28.3.0, the search and milestone pages in 28.4.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:21.406Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-qrrc-h266-v49p",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-qrrc-h266-v49p"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #39839",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39839"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #39847",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39847"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #39885",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39885"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #39938",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39938"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40192",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40192"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40375",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40375"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea pull request disclosure to members with access to issues only"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-129525",
    "datePublished": "2026-11-15T21:14:21.406Z",
    "dateReserved": "2026-11-15T20:31:51.047Z",
    "dateUpdated": "2026-11-15T21:14:21.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The web endpoint that removes an attachment skipped the permission check when the request came from the user who had uploaded the attachment, and it was reachable with read access to issues or pull requests. A user who had uploaded a release asset could still delete it after losing write access to the repository. The endpoint now only deletes attachments that the user uploaded and that are not yet linked to an issue, comment or release."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:19.687Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-jr33-w6w7-86vj",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr33-w6w7-86vj"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40120",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40120"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40268",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40268"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea release asset deletion by former writers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-129341",
    "datePublished": "2026-11-15T21:14:19.687Z",
    "dateReserved": "2026-11-15T20:31:51.058Z",
    "dateUpdated": "2026-11-15T21:14:19.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git over HTTP lowers the required permission for pushes to read access, so that the AGit flow works, and relies on the repository\u0027s server-side hooks to enforce write access. A repository that is still being created by a migration, fork or template generation has no hooks yet, so a user with read access to it could push branches and tags during that window, or after a failed migration that left the repository in that state. Git over HTTP now refuses requests to repositories that are still being created."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:17.755Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-8cjj-9p56-j54f",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8cjj-9p56-j54f"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40120",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40120"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40268",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40268"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea push without write access to repositories still being created"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-129337",
    "datePublished": "2026-11-15T21:14:17.755Z",
    "dateReserved": "2026-11-15T20:31:51.054Z",
    "dateUpdated": "2026-11-15T21:14:17.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.19.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Removing a team\u0027s review request looked up a review by the negated team ID, which for the team with ID 2 is the ID of the built-in Actions user, and marked the review it found as official. In the organization that owns that team, a user who can change the review requests of a pull request could make an approval left by the Actions user count toward the approvals required by branch protection. Merging still required permission to merge. Removing a team review request no longer changes any review."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:16.199Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-74jf-6hjp-549c",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-74jf-6hjp-549c"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40120",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40120"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40268",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40268"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea required approval bypass through team review request removal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-128365",
    "datePublished": "2026-11-15T21:14:16.199Z",
    "dateReserved": "2026-11-15T20:31:51.051Z",
    "dateUpdated": "2026-11-15T21:14:16.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/yagcioglutoprak"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When Gitea acts as an OAuth2 or OpenID Connect provider, the token endpoint did not check the state of the user. After an administrator deactivated an account or prohibited its sign-in, existing refresh tokens and unused authorization codes of that user could still be exchanged for new tokens, so applications that sign users in through Gitea kept them signed in. The token endpoint now refuses users who may not sign in, and token introspection reports their tokens as inactive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:14.486Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-jrjr-q3rq-f899",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jrjr-q3rq-f899"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea OAuth2 provider tokens issued to disabled users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-128359",
    "datePublished": "2026-11-15T21:14:14.486Z",
    "dateReserved": "2026-11-15T20:31:51.070Z",
    "dateUpdated": "2026-11-15T21:14:14.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/lazerg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A pull request review created through the API as a draft (`event` set to `PENDING` or left empty) was added to the pull request timeline and announced through notifications and activity feeds like a submitted review. Its body and line comments were therefore visible to everyone who can read the pull request, including anonymous visitors of a public repository, before the reviewer submitted it. Pending reviews no longer get a timeline entry or notifications until they are submitted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:12.729Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-859w-9wv7-c5x9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-859w-9wv7-c5x9"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40260",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40260"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40272",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40272"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea disclosure of pending pull request reviews created through the API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-127958",
    "datePublished": "2026-11-15T21:14:12.729Z",
    "dateReserved": "2026-11-15T20:31:51.075Z",
    "dateUpdated": "2026-11-15T21:14:12.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Replying to a code review comment accepted a review ID that belongs to a different pull request, through the web form, the API and incoming mail replies. A signed-in user could reply on a pull request they can access with the ID of a review in a repository they cannot read, and the new comment was attached to that review and received the diff context of the commented lines. Replies are now only accepted for a review of the same pull request, and for a pending review only from its author."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:10.802Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-wgx7-537g-xfrg",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wgx7-537g-xfrg"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea private diff disclosure through code comment replies"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-126338",
    "datePublished": "2026-11-15T21:14:10.802Z",
    "dateReserved": "2026-11-15T20:29:37.622Z",
    "dateUpdated": "2026-11-15T21:14:10.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/Alien0ne"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/basavaraj-sm05"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "`GET /api/v1/users/{username}/orgs/{org}/permissions` only checked that the organization is visible to the caller and then returned the named user\u0027s role in it. Any signed-in user could learn whether another user is an owner, admin or member of a public or limited organization, including for members who conceal their membership. The roles are now only returned to the user themselves, to members of the organization and to site administrators."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:09.037Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-7mr2-v9gc-4467",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-7mr2-v9gc-4467"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40042",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40042"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40365",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40365"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea hidden organization membership disclosure through the permissions API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-125617",
    "datePublished": "2026-11-15T21:14:09.037Z",
    "dateReserved": "2026-11-15T20:31:51.067Z",
    "dateUpdated": "2026-11-15T21:14:09.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AGit flow (pushing to `refs/for/...`) did not check the pusher\u0027s access to pull requests again when it created the pull request. A user or deploy key with read access to the code only, or with write access to the wiki over SSH, could open pull requests in a repository where they have no access to pull requests. Creating a pull request through AGit now requires read access to the pull requests of the repository and is refused for wiki pushes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:05.726Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-9827-6wh6-634q",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9827-6wh6-634q"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea pull request creation without pull request access through AGit"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123642",
    "datePublished": "2026-11-15T21:14:05.726Z",
    "dateReserved": "2026-11-15T20:31:51.064Z",
    "dateUpdated": "2026-11-15T21:14:05.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/Bryan-Project"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/yagcioglutoprak"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/lunny"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The \"Protected file patterns\" setting of a branch protection rule was checked against file names as git prints them, and git quotes names that contain a double quote, a backslash or a control character. Such names never matched a pattern, so a user with write access could add or change files under a protected pattern by direct push or through a pull request merge, and could move a protected file out of the pattern\u0027s reach by renaming it. Where the patterns protect workflow files, this allowed adding a workflow that then ran on the repository\u0027s runners. Changed files are now listed unquoted, and a rename reports both the old and the new path."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:03.522Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-w87g-xmrp-86v2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-w87g-xmrp-86v2"
        },
        {
          "name": "Fix on release/v28: go-gitea/gitea pull request #40362",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40362"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea protected file pattern bypass with quoted file names"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123638",
    "datePublished": "2026-11-15T21:14:03.522Z",
    "dateReserved": "2026-11-15T20:29:37.618Z",
    "dateUpdated": "2026-11-15T21:14:03.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/HexDump0"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/ivantsepp"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rather than by the attachments verified to belong to the release. A user with write access to the releases of any repository, including their own, could submit a crafted identifier that resolves to the stored file of another attachment and delete it, provided they know that attachment\u0027s UUID. The attachment record stayed, so downloads of the affected issue, comment or release file failed. Release edits now only delete the files of attachments that belong to the release."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:14:01.669Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-4p89-xcq8-xfhm",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-4p89-xcq8-xfhm"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40120",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40120"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40268",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40268"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea deletion of arbitrary attachment files through release edit"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123065",
    "datePublished": "2026-11-15T21:14:01.669Z",
    "dateReserved": "2026-11-15T20:29:37.615Z",
    "dateUpdated": "2026-11-15T21:14:01.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/adamyordan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a file is edited in a fork through the web editor, Gitea can first copy a branch from the base repository into the fork. That copy did not check whether the user may read the base repository\u0027s code. A user who had forked a repository and later lost access to it, for example after it was made private or they were removed as a collaborator, could keep copying its current branches into their fork and read them. The copy now requires read access to the code of the base repository."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:59.232Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-9vh6-6hgj-j5m5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9vh6-6hgj-j5m5"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea base repository code disclosure through the web editor in forks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123009",
    "datePublished": "2026-11-15T21:13:59.232Z",
    "dateReserved": "2026-11-15T20:29:37.634Z",
    "dateUpdated": "2026-11-15T21:13:59.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/SakusenSec"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/Pedromdsn"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/sandiyochristan"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/glenaster"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gitea accepted an unlimited number of wrong TOTP passcodes during sign-in, in the password reset flow and for Basic authentication with the `X-Gitea-OTP` header. An attacker who already knows an account\u0027s password could guess the six-digit passcode by trying codes at a high rate and sign in despite two-factor authentication. After five failed passcodes, further attempts for the account are now refused for 15 minutes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:56.636Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-5mx6-8rwm-52wf",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-5mx6-8rwm-52wf"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #39993",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39993"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40374",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40374"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea missing attempt limit for TOTP passcodes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123002",
    "datePublished": "2026-11-15T21:13:56.636Z",
    "dateReserved": "2026-11-15T20:29:37.631Z",
    "dateUpdated": "2026-11-15T21:13:56.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner\u0027s package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-460",
              "description": "CWE-460: Improper Cleanup on Thrown Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:54.916Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-q8pg-ggp9-rm9m",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q8pg-ggp9-rm9m"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40120",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40120"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40268",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40268"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea deletion of shared container blobs on rejected uploads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-120991",
    "datePublished": "2026-11-15T21:13:54.916Z",
    "dateReserved": "2026-11-15T20:31:51.061Z",
    "dateUpdated": "2026-11-15T21:13:54.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the response as HTML. A user who can post a comment or other rendered content could add a link that is displayed as an ordinary issue reference but points to a file in a repository they control, so that the popup inserted that file\u0027s content into the page of anyone hovering the link and ran script in the viewer\u0027s session. The popup now requests the issue by the owner, repository and index parsed from the link."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:53.375Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-wmr3-xg9x-vc55",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wmr3-xg9x-vc55"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40207",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40207"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40225",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40225"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea stored cross-site scripting in the issue reference popup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-120729",
    "datePublished": "2026-11-15T21:13:53.375Z",
    "dateReserved": "2026-11-15T20:29:37.625Z",
    "dateUpdated": "2026-11-15T21:13:53.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "With `REQUIRE_SIGNIN_VIEW = true`, the Git LFS endpoints still answered unauthenticated requests for repositories that are not private. An anonymous client who knows the path of such a repository and the SHA-256 of an LFS object could download the object, and could use the batch endpoint to test whether an object exists. The Git LFS endpoints now require authentication when sign-in is required to view the instance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:51.736Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-8pmc-9g44-v9gw",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8pmc-9g44-v9gw"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea anonymous Git LFS access despite required sign-in"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-120725",
    "datePublished": "2026-11-15T21:13:51.736Z",
    "dateReserved": "2026-11-15T20:31:51.073Z",
    "dateUpdated": "2026-11-15T21:13:51.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "1.27.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/danieltk76"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/lmonstergg"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/BOTecko"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/silverwind"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner\u0027s repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:44.684Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-q3q9-39vr-q35j",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40131",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40131"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40281"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea scoped workflow trust kept after repository transfer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-118535",
    "datePublished": "2026-11-15T21:13:44.684Z",
    "dateReserved": "2026-11-15T20:29:37.628Z",
    "dateUpdated": "2026-11-15T21:13:44.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/nithissh7"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/hariprasanth9317-tech"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/basavaraj-sm05"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newline characters. Because the compact index served to clients is line-based, a user who can publish a gem to an owner\u0027s registry could forge index entries, such as packages that do not exist or additional versions of an existing gem with dependencies of their choice. Clients that resolve gems from that registry could then be led to install attacker-chosen dependencies. Gems with such metadata are now rejected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:13:39.832Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-49c9-hm8q-6rvq",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-49c9-hm8q-6rvq"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #39782",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39782"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #39900",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/39900"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.3.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.3.0"
        }
      ],
      "title": "Gitea RubyGems compact index injection through package metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-118389",
    "datePublished": "2026-11-15T21:13:39.832Z",
    "dateReserved": "2026-11-15T20:29:37.637Z",
    "dateUpdated": "2026-11-15T21:13:39.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/grigorovichvlad"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/bircni"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/lunny"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A repository created with auto-init accepted pushes before its initialization had finished, and the initial commit was built in a checkout of whatever the repository already contained. A user who is allowed to create repositories could push a crafted tree during that window so that writing the README followed a symbolic link and overwrote a server-side git hook, which runs commands as the Gitea system user. The initial commit is now built in a freshly initialized directory, and a new repository only becomes ready, and accepts pushes, once its initialization is complete."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:10:23.428Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-6m4f-m9vc-7946",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-6m4f-m9vc-7946"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40376",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40376"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40383",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40383"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea command execution through repository auto-initialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-125423",
    "datePublished": "2026-11-15T21:10:23.428Z",
    "dateReserved": "2026-11-15T20:29:37.607Z",
    "dateUpdated": "2026-11-15T21:10:23.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "gitea.dev",
          "product": "Gitea",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThan": "28.4.0",
              "status": "affected",
              "version": "28.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/lichoin"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/Tfo0"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/bircni"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repository. Since 28.0.0 that object included the repository owner\u0027s full user record, so any signed-in user could read the password hash, salt and email address of the owner of any repository they can see that has a commit status. The response now contains only the state and target URL of the commit status."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T21:10:18.973Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory GHSA-frjx-8pcw-8c9q",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-frjx-8pcw-8c9q"
        },
        {
          "name": "Fix: go-gitea/gitea pull request #40377",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40377"
        },
        {
          "name": "Fix backport to release/v28: go-gitea/gitea pull request #40384",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/go-gitea/gitea/pull/40384"
        },
        {
          "name": "Gitea 28.4.0 release announcement",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/release-of-28.4.0/"
        },
        {
          "name": "go-gitea/gitea v28.4.0 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0"
        }
      ],
      "title": "Gitea password hash disclosure through repository search"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-123006",
    "datePublished": "2026-11-15T21:10:18.973Z",
    "dateReserved": "2026-11-15T20:29:37.611Z",
    "dateUpdated": "2026-11-15T21:10:18.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "js-support-ticket",
          "product": "JS Help Desk",
          "vendor": "Ahmad",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.0.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Elaprendiz1927 | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:23:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects JS Help Desk: from n/a through 5.0.5.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:25.179Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-5-0-5-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress JS Help Desk plugin to the latest available version (at least 5.0.6)."
            }
          ],
          "value": "Update the WordPress JS Help Desk plugin to the latest available version (at least 5.0.6)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress JS Help Desk plugin \u003c= 5.0.5 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125796",
    "datePublished": "2026-11-15T19:00:25.179Z",
    "dateReserved": "2026-11-10T12:37:30.985Z",
    "dateUpdated": "2026-11-15T19:00:25.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wpdiscuz",
          "product": "wpDiscuz",
          "vendor": "AdvancedCoding",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.7.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.6.75",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AndrewN | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:22:55.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.\u003cp\u003eThis issue affects wpDiscuz: from n/a through 7.6.75.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.872Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wpdiscuz/vulnerability/wordpress-wpdiscuz-plugin-7-6-75-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress wpDiscuz plugin to the latest available version (at least 7.7.0)."
            }
          ],
          "value": "Update the WordPress wpDiscuz plugin to the latest available version (at least 7.7.0)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress wpDiscuz plugin \u003c= 7.6.75 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125818",
    "datePublished": "2026-11-15T19:00:24.872Z",
    "dateReserved": "2026-11-10T12:37:30.989Z",
    "dateUpdated": "2026-11-15T19:00:24.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "gutenverse",
          "product": "Gutenverse",
          "vendor": "Jegstudio",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.2.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MYCF711 | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:22:17.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.\u003cp\u003eThis issue affects Gutenverse: from n/a through 4.2.2.\u003c/p\u003e"
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.809Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-plugin-4-2-2-denial-of-service-attack-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Gutenverse plugin to the latest available version (at least 4.2.3)."
            }
          ],
          "value": "Update the WordPress Gutenverse plugin to the latest available version (at least 4.2.3)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Gutenverse plugin \u003c= 4.2.2 - Denial of Service Attack vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125823",
    "datePublished": "2026-11-15T19:00:24.809Z",
    "dateReserved": "2026-11-10T12:37:30.990Z",
    "dateUpdated": "2026-11-15T19:00:24.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "powerpress",
          "product": "PowerPress Podcasting",
          "vendor": "Blubrry Podcasting",
          "versions": [
            {
              "changes": [
                {
                  "at": "11.18.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "11.18.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matt Staton | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:21:23.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.\u003cp\u003eThis issue affects PowerPress Podcasting: from n/a through 11.18.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.437Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-18-3-arbitrary-file-deletion-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress PowerPress Podcasting plugin to the latest available version (at least 11.18.4)."
            }
          ],
          "value": "Update the WordPress PowerPress Podcasting plugin to the latest available version (at least 11.18.4)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress PowerPress Podcasting plugin \u003c= 11.18.3 - Arbitrary File Deletion vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125826",
    "datePublished": "2026-11-15T19:00:24.437Z",
    "dateReserved": "2026-11-10T12:37:30.990Z",
    "dateUpdated": "2026-11-15T19:00:24.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "bit-assist",
          "product": "Bit Assist",
          "vendor": "Bit Apps",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.8.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:21:18.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Bit Apps Bit Assist bit-assist allows DOM-Based XSS.\u003cp\u003eThis issue affects Bit Assist: from n/a through 1.8.4.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Bit Apps Bit Assist bit-assist allows DOM-Based XSS.This issue affects Bit Assist: from n/a through 1.8.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-588",
          "descriptions": [
            {
              "lang": "en",
              "value": "DOM-Based XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.397Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/bit-assist/vulnerability/wordpress-bit-assist-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Bit Assist plugin to the latest available version (at least 1.8.5)."
            }
          ],
          "value": "Update the WordPress Bit Assist plugin to the latest available version (at least 1.8.5)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Bit Assist plugin \u003c= 1.8.4 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125760",
    "datePublished": "2026-11-15T19:00:24.397Z",
    "dateReserved": "2026-11-10T12:37:30.981Z",
    "dateUpdated": "2026-11-15T19:00:24.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "belingogeo",
          "product": "belingoGeo",
          "vendor": "Belingo",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.13.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.13.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "mySebbe | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:20:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Belingo belingoGeo belingogeo allows Reflected XSS.\u003cp\u003eThis issue affects belingoGeo: from n/a through 1.13.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Belingo belingoGeo belingogeo allows Reflected XSS.This issue affects belingoGeo: from n/a through 1.13.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.058Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/belingogeo/vulnerability/wordpress-belingogeo-plugin-1-13-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress belingoGeo plugin to the latest available version (at least 1.13.4)."
            }
          ],
          "value": "Update the WordPress belingoGeo plugin to the latest available version (at least 1.13.4)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress belingoGeo plugin \u003c= 1.13.3 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125830",
    "datePublished": "2026-11-15T19:00:24.058Z",
    "dateReserved": "2026-11-10T12:37:30.990Z",
    "dateUpdated": "2026-11-15T19:00:24.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "ai-engine",
          "product": "AI Engine",
          "vendor": "Meow Apps",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.9.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ashv4ni | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:20:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.\u003cp\u003eThis issue affects AI Engine: from n/a through 3.9.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:24.013Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress AI Engine plugin to the latest available version (at least 3.9.4)."
            }
          ],
          "value": "Update the WordPress AI Engine plugin to the latest available version (at least 3.9.4)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress AI Engine plugin \u003c= 3.9.3 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125804",
    "datePublished": "2026-11-15T19:00:24.013Z",
    "dateReserved": "2026-11-10T12:37:30.987Z",
    "dateUpdated": "2026-11-15T19:00:24.013Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-file-upload",
          "product": "WordPress File Upload",
          "vendor": "Nickboss",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.2.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.2.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "peppa | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:19:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.\u003cp\u003eThis issue affects WordPress File Upload: from n/a through 5.2.3.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:23.675Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-file-upload/vulnerability/wordpress-wordpress-file-upload-plugin-5-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress WordPress File Upload plugin to the latest available version (at least 5.2.4)."
            }
          ],
          "value": "Update the WordPress WordPress File Upload plugin to the latest available version (at least 5.2.4)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress WordPress File Upload plugin \u003c= 5.2.3 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125822",
    "datePublished": "2026-11-15T19:00:23.675Z",
    "dateReserved": "2026-11-10T12:37:30.990Z",
    "dateUpdated": "2026-11-15T19:00:23.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "feedzy-rss-feeds",
          "product": "Feedzy",
          "vendor": "Themeisle",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.2.16",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.2.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AndrewN | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:19:31.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeisle Feedzy feedzy-rss-feeds allows Stored XSS.\u003cp\u003eThis issue affects Feedzy: from n/a through 5.2.15.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Themeisle Feedzy feedzy-rss-feeds allows Stored XSS.This issue affects Feedzy: from n/a through 5.2.15."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:23.614Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/feedzy-rss-feeds/vulnerability/wordpress-feedzy-plugin-5-2-15-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Feedzy plugin to the latest available version (at least 5.2.16)."
            }
          ],
          "value": "Update the WordPress Feedzy plugin to the latest available version (at least 5.2.16)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Feedzy plugin \u003c= 5.2.15 - Cross Site Scripting (XSS) vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-125817",
    "datePublished": "2026-11-15T19:00:23.614Z",
    "dateReserved": "2026-11-10T12:37:30.989Z",
    "dateUpdated": "2026-11-15T19:00:23.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://themeforest.net",
          "defaultStatus": "unaffected",
          "packageName": "grandprix-core",
          "product": "GrandPrix Core",
          "vendor": "Mikado-Themes",
          "versions": [
            {
              "lessThanOrEqual": "1.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-13T18:19:20.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Mikado-Themes GrandPrix Core grandprix-core allows PHP Local File Inclusion.\u003cp\u003eThis issue affects GrandPrix Core: from n/a through 1.0.\u003c/p\u003e"
            }
          ],
          "value": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027) vulnerability in Mikado-Themes GrandPrix Core grandprix-core allows PHP Local File Inclusion.This issue affects GrandPrix Core: from n/a through 1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-252",
          "descriptions": [
            {
              "lang": "en",
              "value": "PHP Local File Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-15T19:00:23.217Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/grandprix-core/vulnerability/wordpress-grandprix-core-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress GrandPrix Core plugin \u003c= 1.0 - Local File Inclusion vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-129091",
    "datePublished": "2026-11-15T19:00:23.217Z",
    "dateReserved": "2026-11-13T15:03:07.521Z",
    "dateUpdated": "2026-11-15T19:00:23.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}