CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
| 13/08/2026 |
| CVE-2026-56750 | 严重9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | 中危6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | 严重9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | 严重9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | 高危8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | 低危2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | 严重9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | 高危7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | 中危4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |
| CVE-2026-42931 | 中危6.5 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | 13/08/2026 |
| CVE-2026-24791 | 高危8.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 13/08/2026 |
| CVE-2026-23603 | 低危3.1 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | 13/08/2026 |
| CVE-2026-34966 | 高危7.6 | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through | 05/08/2026 |
| GO-2026-6074 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea | 27/07/2026 |
| GHSA-rjvx-x5h2-6px5 | 中危 | Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions | 21/07/2026 |