picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks. CVSSv3.1 8.1 (HIGH)
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable. CVSSv3.1 8.4 (HIGH)
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write CVSSv3.1 9.6 (CRITICAL)
Permanent Fork PR Workflow Approval Gate Bypass CVSSv3.1 8.9 (HIGH)
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVSSv3.1 9.8 (CRITICAL) · EPSS 6th percentile
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. CVSSv3.1 8.3 (HIGH)
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.1 (HIGH)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 9.0 (CRITICAL)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.3 (HIGH)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.3 (HIGH)
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 8.1 (HIGH)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.3 (HIGH)
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.3 (HIGH)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 8.1 (HIGH)
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. CVSSv3.1 8.1 (HIGH)
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. CVSSv3.1 8.7 (HIGH)
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. CVSSv3.1 8.8 (HIGH)
Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. CVSSv3.1 8.1 (HIGH)
Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. CVSSv3.1 8.7 (HIGH)
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. CVSSv3.1 8.1 (HIGH)
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access. CVSSv3.1 8.8 (HIGH) · EPSS 10th percentile
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. CVSSv3.1 8.2 (HIGH)