CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 13/08/2026 |
| CVE-2026-56750 | 緊急9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | 中6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | 緊急9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | 緊急9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | 高8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | 低2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | 緊急9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | 高7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | 中4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |
| CVE-2026-42931 | 中6.5 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | 13/08/2026 |
| CVE-2026-24791 | 高8.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 13/08/2026 |
| CVE-2026-23603 | 低3.1 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | 13/08/2026 |
| CVE-2026-34966 | 高7.6 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through | 05/08/2026 |
| GO-2026-6074 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea | 27/07/2026 |
| GHSA-rjvx-x5h2-6px5 | 中 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions | 21/07/2026 |