Heap-based buffer overflow in libmng through 2.0.3 allows a crafted MNG file containing MHDR, DHDR, and a multi-record ORDR chunk to overwrite heap memory when an application calls mng_read or mng_readdisplay, producing attacker-controlled out-of-bounds writes and likely application crashes. The attack is local/file-based and requires the victim to open or process the malicious MNG (UI:P), with no confidentiality impact and limited integrity impact but high availability impact. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) is indicated in the supplied data.
Heap out-of-bounds write in Schism Tracker through 20260524 allows a crafted .ult (UltraTracker) module to corrupt the tracker's instruments pointer array, so that cleanup in csf_destroy() frees attacker-chosen pointers and crashes the application. The defect is in fmt_ult_load_song() in fmt/ult.c, which accepts the file's one-byte sample count without clamping it to MAX_SAMPLES; any build that parses .ult files is affected and no special configuration or privileges are required. Publicly available exploit code exists (the flaw is not in CISA KEV), but the vector is local file parsing that requires the victim to load the file, so the confirmed outcome is denial of service and code execution would additionally depend on controlling heap layout.
WordPress sites running the Salon Booking System plugin before 10.31.11 expose an image-import routine that fetches a caller-supplied URL server-side without validation, letting authenticated accounts with the Salon Staff role or higher pull internal-only resources back through the site and plant attacker-named files in a publicly reachable directory. The same write primitive allows storing a malicious SVG that executes JavaScript in the site's origin for anyone who opens it, giving a staff-level account a path to scripts running against higher-privileged users. Publicly available exploit code exists per the WPScan reference, but the privileged-role prerequisite and the victim interaction needed for the script-execution path keep this a moderate-priority issue rather than an emergency; a vendor patch is available in 10.31.11.
A divide-by-zero in libtta through 2.3 causes an availability-only denial of service: decoding a malformed .tta (True Audio) file whose header declares a zero sample rate triggers a SIGFPE that terminates the host process, including the bundled tta console tool and any third-party application linked against the library. Publicly available exploit code exists - the attacker must recompute the header CRC32 so the corrupt file passes the library's integrity check, then convince a victim to open the file (local vector, user interaction required, PR:N per the supplied vector). Impact is confined to a single-process crash with no privilege gain, code execution, or data disclosure, so real-world priority is low-to-moderate for deployments that actually embed libtta for TTA decoding; no CISA KEV entry is reported for this CVE.
An MPEG system header that declares an undersized packet length causes an integer underflow in stream_header() in MPEGsystem.cpp, wrapping packet_size and letting a crafted file crash any application built on smpeg through version 2.0.0. The attack is local (AV:L) and requires a victim to open the hostile MPEG file through SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, so exploitation is limited to denial of service via reachable assertion or out-of-bounds copy; there is no path to code execution or data exposure in the assessed impact. Publicly available exploit code exists, but the issue is not in CISA KEV and no active exploitation is confirmed - it is a moderate, availability-only defect rather than a high-priority emergency.
Opening a crafted MPEG file with smpeg through 2.0.0 can crash the hosting application through a heap out-of-bounds read in MPEGsystem::FillBuffer(). The issue is reachable only when a local user opens an attacker-controlled file via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data, and the assessed impact is availability-only denial of service. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation.
Authenticated Subscriber-level users on WordPress sites running Modern Events Calendar Lite before 7.36.4 can modify the title, content, and excerpt of arbitrary posts, pages, and custom post types because the plugin's post-update handler fails to verify ownership of the target post ID (CWE-639). This integrity-only authorization bypass (CVSS 6.5, PR:L, UI:N) requires only a low-privilege account obtainable where self-registration is enabled; publicly available exploit code exists, but CISA SSVC records no exploitation and the issue is a moderate-priority content-tampering risk rather than an emergency.
Heap buffer overflow in libtta through 2.3 allows a crafted .tta file to crash 32-bit applications and affect integrity via an integer overflow in the seek-table allocation path. Exploitation requires user interaction to open the malicious audio file and is constrained to 32-bit consumers with specific malformed header values (sample rate 1 and a large samples field); 64-bit builds are not indicated as affected. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation is present in the provided data.
Plane (makeplane/plane) through version 1.4.2 makes security decisions based on the client-supplied X-Forwarded-For header without validating it against a trusted reverse-proxy chain, letting unauthenticated remote attackers spoof their perceived source IP. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), impact is limited to low confidentiality - no integrity or availability effect - and only materializes where the deployment actually uses client IP for access control, rate limiting, or source-IP logging. Publicly available exploit code exists (VulDB and an upstream GitHub issue reference); there is no CISA KEV confirmation of active exploitation.
Improper access control in light0011 CMS allows unauthenticated remote attackers to bypass Captcha Validation enforced in App/Home/Controller/UserController.class.php, enabling limited unauthorized user-related actions. The project has not responded to the reported issue and no vendor-released patch has been identified, while publicly available exploit code exists; CISA KEV does not list this CVE. The assessed impact is limited integrity impact rather than confidentiality or availability compromise.
Missing authentication in the isAdmin() function of admin/admin.php in itsmeravitejak's Online Examination System (rolling-release, no fixed version boundary) lets remote unauthenticated attackers reach administrative logic over the network; publicly available exploit code exists. The assessed impact is low confidentiality only (C:L), with no integrity or availability effect, though CWE-306 on an admin check may expose broader administrative functionality that should be validated against the deployed source. The vendor has not responded to the early issue report, and no CISA KEV entry was provided.
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
SQL injection in the AJAX endpoint of itsmeravitejak Online Examination System (exammanger.php, MySQLDB::topicslist) lets remote attackers manipulate the subject parameter to alter database queries. The project is rolling-release with no version pinning; code through commit e6208e630b14657999bbfe4c9912302d2a1e2449 is affected, and the CVSS vector marks exploitation as unauthenticated (PR:N) with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided and EPSS was not supplied; the maintainer was notified via GitHub issue #7 and has not responded, so no vendor-released patch is identified.
SQL injection in the PHP-based Online Examination System (itsmeravitejak repository, rolling-release up to commit e6208e630b14657999bbfe4c9912302d2a1e2449) lets remote attackers manipulate the id, user, and topic arguments passed into the MySQLDB helper methods, which are concatenated into SQL statements without sanitization. According to the CVSS v4 vector the flaw is remotely reachable without privileges or user interaction, though in practice the affected results.php and reporting endpoints in this class of application typically sit behind a login, so authenticated access may be required - this is not confirmed in the available data. The issue was reported to the maintainer through a public GitHub issue and remains unanswered, and publicly available exploit code exists; EPSS and KEV data were not provided, so active exploitation is unconfirmed. Independent assessment rates the realistic risk medium-to-low: an unauthenticated SQL injection whose practical impact is bounded by low confidentiality, integrity, and availability weighting (VC:L/VI:L/VA:L).
SQL injection in itsmeravitejak's PHP-based Online-Examination-System lets remote, unauthenticated attackers inject arbitrary SQL through the query, qtype, sortname, and sortorder arguments processed by qsdb.php, usersdb.php, brandb.php, topicsdb.php, and subjectsdb.php. Because the project uses no versioning, there is no reliable way to determine which snapshots are affected; the repository's latest known commit e6208e630b14657999bbfe4c9912302d2a1e2449 is in scope, and the maintainer has not responded to the issue report. Publicly available exploit code exists (the CVE record's CVSS 4.0 vector carries E:P), but there is no KEV listing or other indication of active exploitation, and independent assessment rates the practical risk as low-to-moderate and opportunistic because deployments of this obscure, unmaintained application are rare and seldom internet-facing.
SQL injection in the kishan0725 Hospital Management System through commit 777fda46 lets authenticated attackers manipulate the ID parameter in admin-panel.php's Appointment Cancellation Handler and execute arbitrary SQL against the application database. Exploitation requires access to the administrative panel, and publicly available exploit code exists but no CISA KEV active-exploitation entry is associated. The vendor has not responded to the issue report, so no fixed release is available.
Broken access control in the Salon Booking System WordPress plugin before 10.31.11 lets authenticated users who hold the plugin's Salon Staff or Salon Worker role edit arbitrary accounts through the plugin's customers management screen, including demoting administrators to the 'customer' role and overwriting profile fields - resulting in loss of administrative access and possible site lockout. Publicly available exploit code exists, and the vendor has released a fix in version 10.31.11; because the attacker must already hold a staff/worker account, the realistic exposure is insider or compromised-staff-credential abuse rather than unauthenticated remote takeover. The flaw is rated medium severity (CVSS 5.5, CWE-863).
Otter Blocks for WordPress before 3.2.3 allows an open redirect through its Stripe Checkout flow because a user-supplied return URL is not validated as belonging to the site, so victims who complete or cancel checkout can be sent to an arbitrary external destination. Publicly available exploit code exists, but exploitation requires the target site to use the vulnerable Stripe Checkout feature and requires victim interaction during checkout, limiting practical impact to phishing-style redirection rather than server compromise.
Unauthenticated attackers can write design-template data into the metadata of arbitrary posts on WordPress sites running the PickPlugins Product Designer for WooCommerce plugin through 1.0.40, because the plugin performs no capability check, inverts its nonce verification, and does not validate the target post ID. Publicly available exploit code exists and remote unauthenticated exploitation works against default installations with no token harvesting or user interaction, though impact is bounded to integrity of post metadata with no confidentiality or availability effect and no direct code execution. EPSS-style risk signals were not provided, and the issue is not reported as part of CISA KEV, so the practical exposure is a moderate-priority data-integrity problem requiring the plugin to be installed and active.
A broken access control flaw (CWE-862) in the WordPress plugin AI Engine before 3.7.9 lets users holding the Editor role or higher perform AI media management actions against posts they do not own and are not permitted to edit - modifying that content or changing its post type site-wide. Rated CVSS 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), the impact is integrity-only and gated behind a privileged account, so exposure is concentrated in multi-author, agency, or multisite installations that deliberately distrust Editor-level users; single-administrator sites see little practical risk. Publicly available exploit code exists (WPScan published a proof-of-concept entry), but CISA SSVC records no observed exploitation and the vendor has released a fixed version, 3.7.9.
AI Engine WordPress plugin before 3.7.9 allows authenticated users with the Editor role or higher to permanently delete arbitrary posts of any type by passing an object ID they do not own to a media action. The missing ownership/authorization check (CWE-862) lets such users remove navigation menus, block templates, global styles, and other content they cannot normally delete; publicly available exploit code exists. Exploitation requires an Editor+ account, which limits realistic exposure to insider or compromised-account scenarios and keeps this a moderate-priority issue rather than an anonymous internet-facing emergency.
Authenticated users with as little as Contributor access can create, rename, and permanently delete taxonomy terms across any Tasty Recipes Lite site running versions before 1.2.11, because the plugin fails to enforce capability checks on those term-management actions. This permits tampering with categories, tags, and navigation menus, although exploitation requires a valid low-privilege account and the assessed risk is moderate rather than high priority. Publicly available exploit code exists, and the vendor has released 1.2.11 as the fixed version.
Stack-based out-of-bounds read and write in libtta through 2.3 can corrupt decoder memory when an application processes a crafted .tta file whose header declares zero channels. The flaw is local and requires user interaction-the victim must open or decode the malicious file-so systems that never decode untrusted True Audio input are not exposed; impact is assessed as low confidentiality/integrity/availability, consistent with a crash or constrained stack corruption rather than demonstrated reliable code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and the risk is moderate rather than urgent.
Modern Events Calendar Lite before 7.37.0 exposes the personal and payment details of every event booking to any authenticated user, including Subscribers, because its booking-data endpoint lacks capability, nonce, and ownership checks. Publicly available exploit code exists, but exploitation requires a valid low-privilege account, making sites with open registration the most likely targets. The result is a read-only confidentiality breach of names, email addresses, transaction IDs, and payment amounts, assessed as a moderate-priority information disclosure rather than a critical compromise.
Salon Booking System WordPress plugin before 10.31.11 exposes all configured discount coupons-including those hidden from customers-through an insufficiently restricted REST API endpoint reachable by any authenticated user such as a subscriber. The missing authorization check (CWE-284) lets a low-privilege account enumerate coupon codes, amounts, validity dates, and usage limits; publicly available exploit code exists, while the CVSS 4.3 score and PR:L vector reflect limited confidentiality impact. Sites that allow self-registration are the most exposed, though no administrator access, user interaction, or special configuration is required once an account exists.
SQL injection in nemoTyrant manong's func.php cache deletion handler allows remote unauthenticated attackers to influence SQL queries through the arr2sql function, with low confidentiality, integrity, and availability impact. The project uses a rolling release model, so no specific affected or fixed version is available, and any current deployment should be considered potentially exposed; no public exploit was identified at time of analysis, and CISA KEV does not list this CVE.
Unauthenticated file write in the Boa-derived /bin/boa web server on Netcore NR256CN routers (firmware through 1.5.140116) lets remote attackers overwrite the firmware-update and configuration-restore staging files /tmp/boa_temp.update and /tmp/boa_temp.para by POSTing to a non-existent .cgi pathname. The flaw is a missing-authentication weakness (CWE-306) rated CVSS 6.9 with a PR:N/UI:N vector, but impact is bounded: writes are confined to two hardcoded temp paths, so the realistic outcomes are tampering with a pending update or configuration restore and denial of service rather than arbitrary file write or direct code execution. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and practical exposure is limited by the need for the router's management interface to be network-reachable - typically LAN-side on default deployments.
Heap out-of-bounds write in libLAS through 1.8.1 allows attackers to corrupt memory when a victim opens a crafted .las file containing a LASSchema variable length record whose declared schema exceeds 65535 bytes, causing crashes and limited integrity impact. The flaw is local and requires user interaction-the malicious file must be processed by libLAS-consuming tools such as lasinfo, las2las, or las2txt-and no authentication is needed. It is a moderate, not urgent, priority; no public exploit was identified at time of analysis.
Heap out-of-bounds read in LodePNG's getFilterTypesInterlaced() utility in lodepng_util.cpp can disclose adjacent heap memory or crash applications that process a crafted interlaced PNG declaring a raster larger than its decompressed IDAT stream. This is a moderate-severity, local-vector issue rather than a remote-exploitation priority: exploitation requires local access and user interaction, and the vulnerable helper is outside the core decode path. No public exploit identified at time of analysis.
Heap out-of-bounds read in cgltf through 1.15 can be triggered when an application parses an attacker-supplied glTF or GLB asset and calls cgltf_accessor_unpack_floats() on a sparse accessor whose base bufferView defines a byteStride. The crafted file can pass cgltf_validate(), so validation at that layer does not prevent the over-read, and the result is limited to application crashes and limited heap memory disclosure into vertex data. Exploitation is local and requires user interaction to load the malicious asset; no public exploit identified at time of analysis.
An integer overflow in libspatialite's WKB geometry parser - the point/vertex count size guard in ParseWkbLine and related routines in gg_wkb.c - lets a crafted geometry BLOB with an oversized declared point count slip past the bounds check, resulting in out-of-bounds reads. Any application that links libspatialite 5.1.0 or earlier and opens untrusted spatial data, most commonly a SpatiaLite database file, is affected: triggering the flaw crashes the process, and on 32-bit builds the same overflow can corrupt heap memory. The vector is local and file-driven (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), so exploitation requires the victim or an automated ingest pipeline to parse an attacker-supplied file; no public exploit code and no confirmed active exploitation were identified at time of analysis.
libspatialite through 5.1.0 can be driven into uncontrolled memory allocation and denial of service when it parses a crafted polygon WKB geometry whose interior-ring count is not checked against the BLOB contents. The issue is reachable through malicious SpatiaLite databases or untrusted input passed to ST_GeomFromWKB, requires user interaction to load the crafted data, and can crash the process; on 32-bit builds the resulting heap corruption may be more severe. No CISA KEV entry or public exploit code was identified in the supplied intelligence, and the assessed impact is local denial of service with limited integrity impact.
JWT expiration enforcement in @fastify/jwt versions prior to 10.2.5 can be silently disabled because top-level sign() and verify() replace, rather than merge, globally configured JWT options with any per-call options object. Applications that use those top-level APIs while relying on global expiresIn or maxAge settings may issue tokens with no exp claim and accept stale tokens beyond the intended maximum age; route-level sign/verify decorators are unaffected. The vendor-released patch is 10.2.5, and no public exploit is identified at time of analysis, with no CISA KEV confirmation of active exploitation.
LobsterAI before 2026.10.16 encrypts exported provider API keys with a hardcoded compile-time constant ('lobsterai-APP') instead of a user-supplied secret, so anyone who obtains a provider export file can derive the AES-GCM key via PBKDF2 with the embedded salt and recover every third-party AI provider API key in cleartext. The CVSS 4.0 vector (AV:L/PR:N/UI:P, VC:H only) reflects that exploitation is unauthenticated in principle but requires the victim to have used the export feature and the attacker to separately obtain the resulting JSON file - this is a moderate-priority confidentiality issue, not a high-urgency remote threat, and no public exploit code was identified at time of analysis. Netease Youdao has released a fix in LobsterAI 2026.10.16.
Opening a crafted DVD or disc image in applications that use libdvdnav before 7.0.0 can trigger a heap out-of-bounds read during chapter enumeration and crash the application. The attacker supplies media whose VMGI title declares a vts_ttn larger than the corresponding title set's part-of-title entries; exploitation is local and requires the victim to open the crafted media, and only availability is affected. No public exploit has been identified at time of analysis, and the vendor has released a patch.
Opening a crafted DVD or disc image in a media player built on VideoLAN libdvdnav through 7.0.0 can crash the application through an out-of-bounds read in DVD navigation handling. The fault is triggered when the disc's First Play program chain issues a JumpTT command with title 0 or an oversized title number, causing the library to index past its heap title table because validation relies on an assert rather than a runtime bounds check. Exploitation requires local delivery and user playback of the malicious media, no public exploit was identified at time of analysis, and the assessed impact is denial of service only.
Divide-by-zero in libschroedinger (Schroedinger) through 1.0.11 allows local attackers to crash applications that decode a crafted Dirac stream, resulting in denial of service. The flaw is reached when a low-delay picture supplies a zero slice_bytes_denom or slice count, causing SIGFPE in schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data. Exploitation requires the victim to open or process a malicious media file (user interaction), and no public exploit code has been identified at time of analysis; impact is limited to availability.
Decoding a crafted low-delay Dirac stream with an out-of-range wavelet filter index (7 or greater) or transform depth (5 or 6) in libschroedinger through 1.0.11 triggers an out-of-bounds read past a static quantiser table, crashing the application. The flaw is availability-only (no code execution, data disclosure, or integrity impact) and requires local access plus user interaction to process the malicious stream; no public exploit was identified at time of analysis, and the issue is assessed as moderate severity.
Denial of service in OW2 ASM 9.11 before 9.11.1 occurs when a build tool, instrumenter, agent, or analyzer uses ClassReader.accept() to transform an attacker-supplied class whose rewritten method body grows beyond 65535 bytes; 16-bit forward-reference offsets truncate in Label.resolve() and cause an infinite loop that hangs the affected process. The issue is local (AV:L) and requires the victim to process a crafted class through a code-growing transformation path (UI:R), with impact limited to availability of that single process and no code execution or data disclosure. No public exploit code was identified at time of analysis and no CISA KEV entry is associated; the vendor addressed the flaw in ASM 9.11.1.
A crafted Microsoft Word .doc file can crash applications built on wvWare wv through 1.2.9 by triggering a heap-based out-of-bounds read in the wvGetSTSH stylesheet parser. The issue is local and requires the victim to open the malicious document; the assessed impact is availability-only, with no code execution or data disclosure established. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Stack-based out-of-bounds read in wvWare wv through 1.2.9 allows an unauthenticated local attacker to cause a client-side denial of service: a victim must open a crafted .doc file whose FKP structure carries an oversized crun value, triggering wvGetPAPX_FKP or wvGetCHPX_FKP to read past a 512-byte stack buffer and crash AbiWord or another libwv-based reader. The assessed impact is availability only (CVSS 4.0 local, UI:P, A:H; CVSS 3.1 local, UI:R, A:H), with no confidentiality or integrity impact established. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Path traversal in Vita3K builds before 4187 allows a crafted .vpk archive to write files outside the emulator's install directory, potentially leading to host code execution with the privileges of the Vita3K process. Exploitation is local and requires the victim to install a malicious package, so risk is moderate-to-low for most environments but non-trivial for users who routinely sideload .vpk files. No public exploit code has been identified at time of analysis, and the flaw is remediated in build 4187.
Code injection (CWE-94) in the HivePress WordPress plugin, affecting versions through 1.7.32, allows an authenticated user holding only low privileges to influence the generation of executable code on the host site, with the assessed impact falling entirely on confidentiality. Exploitation is network-reachable at low complexity with no user interaction, but it is gated by authentication (CVSS PR:L), so an attacker must first obtain a valid account on the target WordPress installation - fully unauthenticated visitors cannot exploit it. EPSS, CISA KEV, and public exploit-code status were not provided in the source data, so no active-exploitation signal can be asserted; the vendor's fix version is likewise not enumerated in the available input, and remediation details should be confirmed against the Patchstack advisory.
Authentication bypass in the VideoWhisper '2Way VideoCalls and Random Chat' WordPress plugin (webcam-2way-videochat) through version 6.1.5 lets remote attackers reach protected plugin functionality without valid credentials, yielding low confidentiality and integrity impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Because the vector shows no privileges and no user interaction, any network-reachable WordPress site with this plugin active is exposed, though the population at risk is limited to sites that deliberately installed this niche webcam/chat plugin. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Missing authorization in WPExperts Advanced File Manager through 5.4.14 allows network attackers to reach plugin actions that lack proper access-control checks, with limited integrity and availability impact and no confidentiality loss. The Patchstack advisory tags the issue as an authentication bypass; the published CVSS base is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), while the independent assessment rates it PR:L and cautions that realistic exploitation often requires a low-privileged authenticated WordPress account that can access the vulnerable handlers. No public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation was provided.
Missing authorization in the Kit (formerly ConvertKit) WordPress plugin through 3.4.6 lets unauthenticated remote attackers perform limited unauthorized reads and writes against plugin-managed data and functions. The flaw is a CWE-862 access-control gap rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), affecting default installations with no privileges or user interaction required. No public exploit identified at time of analysis.
Missing per-user authorization middleware on seven Gitea API routes lets any authenticated account holding an API token with read-user scope enumerate the followers, following list, starred and watched repositories, and public SSH/GPG keys of individual users whose profile is set to 'limited' or 'private' visibility, which should otherwise be hidden from them. It affects Gitea up to and including 1.27.2 and is fixed in 1.27.3 and 28.0.0, with the disclosure shipped alongside the 28.2.0 release; exploitation requires a valid account and token (PR:L) and only works against non-public users, so the practical impact is moderate information disclosure rather than a critical exposure. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-urgency bug that is nonetheless trivially scriptable once an account is obtained.
Authenticated users on a Gitea instance can harvest private-profile information - full name, location, website, and free-text description - from other accounts by sending requests to the POST /{username} follow and unfollow endpoint, because the profile visibility check was applied only to GET requests while the POST handler merely required a signed-in session. Anyone holding a valid account on Gitea 1.22.0 through 28.0.0 (self-registration, where enabled, is enough) can pull these fields from the response for any target whose profile visibility is set to private; public profiles expose nothing new. The vendor fixed the flaw in 28.1.0 and disclosed it alongside the 28.2.0 release; there is no public exploit code identified at time of analysis, it is not in CISA KEV, and EPSS is low at roughly 0.16% (4th percentile), so this is a genuine but modest-priority information-disclosure issue.
Memory exhaustion in Gitea's Actions artifact v4 (Twirp) service lets an authenticated user who can run a workflow crash the server process by sending an oversized request body to the artifact handlers. The handlers called io.ReadAll on the request body without any size cap, so a single large POST from a run's runner token can consume all available memory and terminate the Gitea process, denying service to all users. The issue is rated CVSS 6.5 (availability-only, PR:L - authenticated, no user interaction), affects Gitea 1.22.0 through 28.1.0, and is fixed in 28.2.0; no public exploit code was identified and EPSS is only 0.16% (4th percentile), consistent with an SSVC assessment of no observed exploitation and low automatability.