CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Webhook Authorization Header Returned in Plaintext via API |
| 13/08/2026 |
| CVE-2026-58510 | 中危4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | 13/08/2026 |
| CVE-2026-58507 | 中危5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint | 13/08/2026 |
| CVE-2026-58445 | 低危2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | 13/08/2026 |
| CVE-2026-58444 | 中危4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | 13/08/2026 |
| CVE-2026-58443 | 严重9.1 | Public-only repository tokens can update private PR head branches | 13/08/2026 |
| CVE-2026-58442 | 中危6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass | 13/08/2026 |
| CVE-2026-58441 | 中危6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | 13/08/2026 |
| CVE-2026-58440 | 中危6.8 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) | 13/08/2026 |
| CVE-2026-58438 | 高危7.5 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | 13/08/2026 |
| CVE-2026-58437 | 高危7.1 | Repository Visibility Manipulation via Git Push Options | 13/08/2026 |
| CVE-2026-58436 | 高危7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 13/08/2026 |
| CVE-2026-58435 | 中危5.4 | Gitea LFS Deploy-Key Privilege Escalation | 13/08/2026 |
| CVE-2026-58434 | 高危7.5 | Private Repository Metadata Remains Accessible After Access Revocation | 13/08/2026 |
| CVE-2026-58432 | 中危5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | 13/08/2026 |
| CVE-2026-58431 | 中危4.3 | Public-only API token restriction is not enforced on team API routes | 13/08/2026 |
| CVE-2026-58429 | 中危4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | 13/08/2026 |