CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
| 13/08/2026 |
| CVE-2026-56750 | CRITICO9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | MEDIO6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | CRITICO9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | CRITICO9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | ALTO8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | BASSO2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | CRITICO9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | ALTO7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | MEDIO4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |
| CVE-2026-42931 | MEDIO6.5 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | 13/08/2026 |
| CVE-2026-24791 | ALTO8.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 13/08/2026 |
| CVE-2026-23603 | BASSO3.1 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | 13/08/2026 |
| CVE-2026-34966 | ALTO7.6 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through | 05/08/2026 |
| GO-2026-6074 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea | 27/07/2026 |
| GHSA-rjvx-x5h2-6px5 | MEDIO | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions | 21/07/2026 |