CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
REST API exposes organization membership of private organizations to public |
| 13/08/2026 |
| CVE-2026-58416 | 높음7.1 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | 13/08/2026 |
| CVE-2026-58314 | 높음7.7 | Two SSRF findings in Gitea 1.26.2 | 13/08/2026 |
| CVE-2026-57897 | 보통6.5 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | 13/08/2026 |
| CVE-2026-57894 | 높음8.5 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | 13/08/2026 |
| CVE-2026-57886 | 보통5.9 | Cross-repository issue/comment attachment re-linking can expose private attachment content | 13/08/2026 |
| CVE-2026-56755 | 보통6.2 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | 13/08/2026 |
| CVE-2026-56750 | 심각9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | 보통6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | 심각9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | 심각9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | 높음8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | 낮음2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | 심각9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | 높음7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | 보통4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |