126066 matches found
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58507
Private Repository Existence Disclosure via go-get Meta Endpoint...
CVE-2026-58510
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
CVE-2026-58417
REST API exposes organization membership of private organizations to public...
CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content...
CVE-2026-24791
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...
CVE-2026-58510
The Gitea platform is affected by a vulnerability where the ClearRepoWatches fix was not applied to the API EditRepo path. This issue occurs because a sister code path retains stale watches when a repository's visibility is changed from public to private . This exposure of sensitive information t...
CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
EUVD-2026-58123
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
Private Repository Existence Disclosure via go-get Meta Endpoint...
CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
EUVD-2026-58171
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...