Comparison Overview
Vision Express
Vision Express
Ruddington Fields Business Park, Ruddington, Nottingham, NG11 6NZ, GB
Last Update: 11/03/2026
Since 1988, we’ve been leading the way in optical retail across the UK, Ireland and Jersey. We know that Vision isn’t just one of our most powerful senses - it’s the foundation for confidence, connection, and opportunity. Everyone deserves access to expert eye care and...
The TJX Companies, Inc.
770 Cochituate Road, Framingham, 01701, US
Last Update: 02/10/2026
TJX is the leading off-price apparel and home fashions retailer in the U.S. and worldwide, with four global home offices, seven brands, nearly 4,700 stores in nine countries, and five distinctive branded e-commerce sites. As Associates, we make a difference with our con...
Compliance Ranges Comparison
Vision Express
The TJX Companies, Inc.
Benchmark & Cyber Underwriting Signals
Incidents vs Retail Industry Avg (This Year)
No incidents recorded for Vision Express in 2026.
Incidents vs Retail Industry Avg (This Year)
No incidents recorded for The TJX Companies, Inc. in 2026.
Incident History - Vision Express (X = Date, Y = Severity)
Vision Express cyber incidents detection timeline including parent company and subsidiaries.
Incident History - The TJX Companies, Inc. (X = Date, Y = Severity)
The TJX Companies, Inc. cyber incidents detection timeline including parent company and subsidiaries.
Notable Incidents
Vision Express
The TJX Companies, Inc.
FAQ
Latest Global CVEs
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.