tag
Oauth2
Critical
Rocket.Chat OAuth2 NoSQL Injection Privilege Escalation — CVE-2026-29198
CVE-2026-29198·
Rocket.Chat (OAuth2 login flow)
patched
Medium
PocketBase OAuth2 Account Pre-Hijacking (CVE-2026-44166)
CVE-2026-44166 / [GHSA-pq7p-mc74-g65w](https://github.com/pocketbase/pocketbase/security/advisories/GHSA-pq7p-mc74-g65w)·
[PocketBase](https://github.com/pocketbase/pocketbase) (Go backend / BaaS)
unpatched
High
Gitea OAuth2 Scope Enforcement Bypass via HTTP Basic Auth — CVE-2026-28699
CVE-2026-28699·
Gitea (code.gitea.io/gitea)
patched