CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| FAIBLE2.7 |
Webhook Authorization Header Returned in Plaintext via API |
| 13/08/2026 |
| CVE-2026-58510 | MOYENNE4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | 13/08/2026 |
| CVE-2026-58507 | MOYENNE5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint | 13/08/2026 |
| CVE-2026-58445 | FAIBLE2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | 13/08/2026 |
| CVE-2026-58444 | MOYENNE4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | 13/08/2026 |
| CVE-2026-58443 | CRITIQUE9.1 | Public-only repository tokens can update private PR head branches | 13/08/2026 |
| CVE-2026-58442 | MOYENNE6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass | 13/08/2026 |
| CVE-2026-58441 | MOYENNE6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | 13/08/2026 |
| CVE-2026-58439 | ÉLEVÉE8.1 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | 13/08/2026 |
| CVE-2026-58437 | ÉLEVÉE7.1 | Repository Visibility Manipulation via Git Push Options | 13/08/2026 |
| CVE-2026-58436 | ÉLEVÉE7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 13/08/2026 |
| CVE-2026-58435 | MOYENNE5.4 | Gitea LFS Deploy-Key Privilege Escalation | 13/08/2026 |
| CVE-2026-58434 | ÉLEVÉE7.5 | Private Repository Metadata Remains Accessible After Access Revocation | 13/08/2026 |
| CVE-2026-58432 | MOYENNE5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | 13/08/2026 |
| CVE-2026-58429 | MOYENNE4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | 13/08/2026 |
| CVE-2026-58428 | MOYENNE6.5 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | 13/08/2026 |
| CVE-2026-58425 | MOYENNE4.3 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | 13/08/2026 |