2081 matches found
CVE-2026-58508
Technical details (affected product/component, root cause, impact, and exploitation specifics) are not publicly available in the provided documents. Monitor for official disclosures and updates.
CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation (CVE-2026-58435) affects Gitea prior to patch in 1.25.5, per advisory GHSA-rh79-75qm-gwjr. Root cause: when a write deploy key authenticates over SSH, the code sets UserID to the repo owner and embeds this into the LFS JWT, then cross-repo access decision...
CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation
Gitea LFS Deploy-Key Privilege Escalation...
CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58432
CVE-2026-58432 relates to Gitea (code.gitea.io/gitea) and describes missing authorization and an authorization bypass via a user-controlled key, plus incorrect permissions on a critical resource that could expose sensitive information to an unauthorized actor. The CVE is rated with CVSS v3.1 base...
CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2...
CVE-2026-58314
CVE-2026-58314 _ Two SSRF findings in Gitea 1.26.2. The NVD entry reports two SSRF vulnerabilities in Gitea 1.26.2 with CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N and a base score of 7.7 (HIGH). The connected sources also reference public advisories and a later release addressi...
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2...
CVE-2026-56750
CVE-2026-56750 describes a vulnerability in Gitea where Remember-Me tokens fail to invalidate prior attacker sessions, enabling session persistence after compromise. The root cause is described as deficiencies in access control, potentially enabling privilege-related impact. Publicly documented i...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
CVE-2026-56657 Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service...
EUVD-2026-58144
Gitea SSH Key Parser Denial of Service...
CVE-2026-56657
CVE-2026-56657 – Gitea SSH Key Parser DoS : Affects Gitea; vulnerability resides in the SSH key parser, enabling a Denial of Service condition. CVSSv3.1 indicates LOCAL attack vector, low attack complexity, no privileges, no user interaction, with Availability Impact HIGH and Confidentiality/Inte...