CVE-2026-112050

LowCVSS 3.1/10Last modified Oct 19, 2026

Description

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 18, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1120516.5Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitr CVE-2026-1120526.1libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and rela CVE-2026-1120535.5Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantis CVE-2026-1120545.5Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying CVE-2026-1120555.5wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated CVE-2026-1120565.5wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash a CVE-2026-1120575.5libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyo CVE-2026-1120585.5VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supp CVE-2026-1120596.1libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size CVE-2026-112066.5Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data CVE-2026-1120606.4librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 p CVE-2026-1120614.3librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element co