CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 13/08/2026 |
| CVE-2026-58510 | 中4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | 13/08/2026 |
| CVE-2026-58507 | 中5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint | 13/08/2026 |
| CVE-2026-58445 | 低2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | 13/08/2026 |
| CVE-2026-58444 | 中4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | 13/08/2026 |
| CVE-2026-58443 | 緊急9.1 | Public-only repository tokens can update private PR head branches | 13/08/2026 |
| CVE-2026-58442 | 中6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass | 13/08/2026 |
| CVE-2026-58441 | 中6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | 13/08/2026 |
| CVE-2026-58440 | 中6.8 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) | 13/08/2026 |
| CVE-2026-58438 | 高7.5 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | 13/08/2026 |
| CVE-2026-58437 | 高7.1 | Repository Visibility Manipulation via Git Push Options | 13/08/2026 |
| CVE-2026-58436 | 高7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 13/08/2026 |
| CVE-2026-58435 | 中5.4 | Gitea LFS Deploy-Key Privilege Escalation | 13/08/2026 |
| CVE-2026-58434 | 高7.5 | Private Repository Metadata Remains Accessible After Access Revocation | 13/08/2026 |
| CVE-2026-58432 | 中5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | 13/08/2026 |
| CVE-2026-58431 | 中4.3 | Public-only API token restriction is not enforced on team API routes | 13/08/2026 |
| CVE-2026-58429 | 中4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | 13/08/2026 |