Search
Search Results (376996 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58436 | 2026-08-13 | N/A | ||
| ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | ||||
| CVE-2026-58435 | 2026-08-13 | N/A | ||
| Gitea LFS Deploy-Key Privilege Escalation | ||||
| CVE-2026-58434 | 2026-08-13 | N/A | ||
| Private Repository Metadata Remains Accessible After Access Revocation | ||||
| CVE-2026-58433 | 2026-08-13 | N/A | ||
| Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | ||||
| CVE-2026-58432 | 2026-08-13 | N/A | ||
| Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | ||||
| CVE-2026-58431 | 2026-08-13 | N/A | ||
| Public-only API token restriction is not enforced on team API routes | ||||
| CVE-2026-58429 | 2026-08-13 | N/A | ||
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||||
| CVE-2026-58428 | 2026-08-13 | N/A | ||
| Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | ||||
| CVE-2026-58427 | 2026-08-13 | N/A | ||
| Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | ||||
| CVE-2026-58425 | 2026-08-13 | N/A | ||
| OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | ||||
| CVE-2026-58420 | 2026-08-13 | N/A | ||
| Local File Inclusion via file:// URI in Migration Restore | ||||
| CVE-2026-58417 | 2026-08-13 | N/A | ||
| REST API exposes organization membership of private organizations to public | ||||
| CVE-2026-58416 | 2026-08-13 | N/A | ||
| Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | ||||
| CVE-2026-58314 | 2026-08-13 | N/A | ||
| Two SSRF findings in Gitea 1.26.2 | ||||
| CVE-2026-57897 | 2026-08-13 | N/A | ||
| Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | ||||
| CVE-2026-57894 | 2026-08-13 | N/A | ||
| Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | ||||
| CVE-2026-57886 | 2026-08-13 | N/A | ||
| Cross-repository issue/comment attachment re-linking can expose private attachment content | ||||
| CVE-2026-56755 | 2026-08-13 | N/A | ||
| Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | ||||
| CVE-2026-56750 | 2026-08-13 | N/A | ||
| Gitea Remember-Me Token Theft Not Invalidating Attacker Session | ||||
| CVE-2026-56657 | 2026-08-13 | N/A | ||
| Gitea SSH Key Parser Denial of Service | ||||