2081 matches found
GO-2026-4910 vulnerabilities
Vulnerabilities for packages: xeol, osv-scanner, flux-source-controller, guac, src-fingerprint, gitaly, gitlab-runner, kubescape, pulumi-kubernetes-operator, snyk-cli, gomplate, steampipe, pulumi-language-yaml, zarf, flux-image-automation-controller, chezmoi, flux, grype, apko, trivy, zot, melang...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: cilium, crossplane-provider-aws-sqs, flux-source-controller, docker, docker-compose, fscrypt, policy-controller, steampipe, terraform-provider-azurerm, flux, neuvector-sigstore-interface, falco-no-driver, flux-kustomize-controller, slsa-verifier, k3s,...
CVE-2026-56657
A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A remote attacker could potentially exploit this by submitting a specially crafted SSH key, leading to the unavailability of the Gitea service. Mitigation Mitigation for this issue is either not availabl...
CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58314
Two SSRF findings in Gitea 1.26.2...
CVE-2026-56657
Gitea SSH Key Parser Denial of Service...
CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-24059
The CVE-2026-24059 detail shows a flaw in the Gitea runner registration-token GET endpoint: when invoked at project- or owner-level, it creates a new runner registration token if none exists, but is gated by a read-only scope. A leaked read:user-scoped token can therefore mint a registration toke...
CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
EUVD-2026-58125
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
CVE-2026-59763
CVE-2026-59763 affects Gitea’s package upload flow, where unbounded Arch package file metadata can cause resource amplification (availability impact). The issue is tied to Arch metadata handling in the package upload pipeline, leading to potential denial of service through resource exhaustion. Pu...
CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...