176492 matches found
SUSE CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
SUSE CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
SUSE CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore...
SUSE CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...
SUSE CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass...
SUSE CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
SUSE CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
SUSE CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
SUSE CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
SUSE CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked - ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
SUSE CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
SUSE CVE-2026-58511
Webhook Authorization Header Returned in Plaintext via API...
CVE-2026-11771
OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...
CVE-2026-11771
OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...
SUSE CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
SUSE CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher - Reads Internal Files and Cloud Metadata...
SUSE CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
SUSE CVE-2026-59940
unknown...
SUSE CVE-2026-61632
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...