CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
Webhook Authorization Header Returned in Plaintext via API |
| 13/08/2026 |
| CVE-2026-58510 | 中4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | 13/08/2026 |
| CVE-2026-58507 | 中5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint | 13/08/2026 |
| CVE-2026-58445 | 低2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | 13/08/2026 |
| CVE-2026-58444 | 中4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | 13/08/2026 |
| CVE-2026-58443 | 緊急9.1 | Public-only repository tokens can update private PR head branches | 13/08/2026 |
| CVE-2026-58442 | 中6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass | 13/08/2026 |
| CVE-2026-58441 | 中6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | 13/08/2026 |
| CVE-2026-58439 | 高8.1 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | 13/08/2026 |
| CVE-2026-58437 | 高7.1 | Repository Visibility Manipulation via Git Push Options | 13/08/2026 |
| CVE-2026-58436 | 高7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 13/08/2026 |
| CVE-2026-58435 | 中5.4 | Gitea LFS Deploy-Key Privilege Escalation | 13/08/2026 |
| CVE-2026-58434 | 高7.5 | Private Repository Metadata Remains Accessible After Access Revocation | 13/08/2026 |
| CVE-2026-58432 | 中5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | 13/08/2026 |
| CVE-2026-58429 | 中4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | 13/08/2026 |
| CVE-2026-58428 | 中6.5 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | 13/08/2026 |
| CVE-2026-58425 | 中4.3 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | 13/08/2026 |