33911 matches found
EUVD-2026-58170
Public-only repository tokens can update private PR head branches...
EUVD-2026-58169
Repository migration SSRF via multi-answer DNS allow-list bypass...
EUVD-2026-58167
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
EUVD-2026-58165
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
EUVD-2026-58166
Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...
EUVD-2026-58164
Repository Visibility Manipulation via Git Push Options...
EUVD-2026-58163
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
EUVD-2026-58162
Gitea LFS Deploy-Key Privilege Escalation...
EUVD-2026-58161
Private Repository Metadata Remains Accessible After Access Revocation...
EUVD-2026-58160
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting...
EUVD-2026-58156
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
EUVD-2026-58158
Public-only API token restriction is not enforced on team API routes...
EUVD-2026-58157
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
EUVD-2026-58155
Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...
EUVD-2026-58153
Local File Inclusion via file:// URI in Migration Restore...
EUVD-2026-58154
OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...
EUVD-2026-58151
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
EUVD-2026-58149
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...