CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
| 13/08/2026 |
| CVE-2026-56750 | 심각9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | 보통6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | 심각9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | 심각9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | 높음8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | 낮음2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | 심각9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | 높음7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | 보통4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |
| CVE-2026-42931 | 보통6.5 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | 13/08/2026 |
| CVE-2026-24791 | 높음8.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 13/08/2026 |
| CVE-2026-23603 | 낮음3.1 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | 13/08/2026 |
| CVE-2026-34966 | 높음7.6 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through | 05/08/2026 |
| GO-2026-6074 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea | 27/07/2026 |
| GHSA-rjvx-x5h2-6px5 | 보통 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions | 21/07/2026 |