Gitea ParseControlFile Function DoS

The vulnerability of the ParseControlFile function in the modules/packages/debian/metadata.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea IsMigrateURLAllowed Function Information Disclosure

The vulnerability of the IsMigrateURLAllowed function in the services/migrations/migrate.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea IntrospectOAuth Disclosure

The vulnerability of the IntrospectOAuth function in the routers/web/auth/oauth2provider.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Data Compromise

The vulnerability of the services/lfs/server.go and routers/private/serv.go files of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected...

Gitea Locale DoS

The vulnerability of the Locale function in the modules/web/middleware/locale.go file of the Git repository management system Gitea is related to the improper implementation of flow control. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Gitea ChangeTargetBranch Privilege Bypass

The vulnerability of the ChangeTargetBranch function in the services/pull/pull.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges or circumvent security restrictio...

Gitea Disclosure Information Disclosure

The vulnerability of the getStarredRepos function in the routers/api/v1/user/star.go file and the ListMyTrackedTimes function in the routers/api/v1/repo/issuetrackedtime.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability...

Gitea init-function internalAPITransport Internal

The vulnerability of the init-function in the internalAPITransport function in the modules/private/internal.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentialit...

Gitea Data Compromise

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

Gitea API Disclosure Sensitive Information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea Path Traversal

The vulnerability of the Git repository management system Gitea’s path/owner/repo is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to expose the protected information...

Gitea ToHook Function Information Disclosure

The vulnerability of the ToHook function in the services/webhook/general.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by this functio...

Gitea handleOAuth2SignIn OAuth2 Bypass

The vulnerability of the handleOAuth2SignIn function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protecte...

Gitea API Endpoint Protected Information Exposure

The vulnerability of the endpoint /api/v1/teams/teamid of the Gitea Git repository management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea DeleteCollaboration Disclosure

The vulnerability of the DeleteCollaboration function in the services/repository/collaboration.go file of the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea DeleteIssueLabel Function Information Disclosure

The vulnerability of the DeleteIssueLabel function in the routers/api/v1/repo/issuelabel.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected...

Gitea Privilege Escalation

The vulnerability of the CreateAccessToken function in the routers/api/v1/user/app.go file and the reqBasicOrRevProxyAuth function in the routers/api/v1/api.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a...

Gitea /login/oauth/userinfo Data Compromise

The vulnerability of the final point /login/oauth/userinfo of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the tool controller. Specifically, the get_tool and update_tool functions in superagi/controllers/tool.py accept a caller-supplied tool_id but fail to verify if the organization owns the associated toolkit. This ...