CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
REST API exposes organization membership of private organizations to public |
| 13/08/2026 |
| CVE-2026-58416 | 高危7.1 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | 13/08/2026 |
| CVE-2026-58314 | 高危7.7 | Two SSRF findings in Gitea 1.26.2 | 13/08/2026 |
| CVE-2026-57897 | 中危6.5 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | 13/08/2026 |
| CVE-2026-57894 | 高危8.5 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | 13/08/2026 |
| CVE-2026-57886 | 中危5.9 | Cross-repository issue/comment attachment re-linking can expose private attachment content | 13/08/2026 |
| CVE-2026-56755 | 中危6.2 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | 13/08/2026 |
| CVE-2026-56750 | 严重9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | 13/08/2026 |
| CVE-2026-56657 | 中危6.2 | Gitea SSH Key Parser Denial of Service | 13/08/2026 |
| CVE-2026-56654 | 严重9.8 | Privilege Escalation via Access Token Scope Escalation in API | 13/08/2026 |
| CVE-2026-56443 | 严重9.6 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | 13/08/2026 |
| CVE-2026-55987 | 高危8.1 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | 13/08/2026 |
| CVE-2026-55984 | 低危2.7 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | 13/08/2026 |
| CVE-2026-55982 | 严重9.1 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | 13/08/2026 |
| CVE-2026-54481 | 高危7.5 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 13/08/2026 |
| CVE-2026-50105 | 中危4.3 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | 13/08/2026 |