CVE-2026-17594

CVE-2026-17594 affects Nexus Repository 3 CE/Pro versions 3.0.0–3.94.x. The root cause is an authorization mismatch in the repository-creation UI: a delegated repository-admin (scoped to a specific format) could cause a repository of a different, unauthorized format to be created because authoriz...

CVE-2026-17594 Nexus Repository 3 - Authorization Bypass in Repository Creation

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

GHSA-HMQ2-W58F-27JC GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

Summary GitPython computes the on-disk location of a submodule's separate Git directory .git/modules/ from the submodule's .gitmodules section name with no validation. Because that name is fully attacker-controlled content of a cloned repository, a malicious repository can set a submodule name to...

CVE-2026-14934

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...

CVE-2026-14934

CVE-2026-14934 affects Google Cloud BigQuery, Dataform and Colab Enterprise repository creation functionality. A Missing Authorization flaw in versions from October 2025 through May 10, 2026 allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The ...

BIT-GITLAB-2025-12506 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from t...

Linux Distros Unpatched Vulnerability : CVE-2025-12506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...

CVE-2025-12506

CVE-2025-12506 affects GitLab CE/EE prior to the patched releases: 16.5–before 18.11.7, 19.0–before 19.0.4, and 19.1–before 19.1.2. The issue stems from improper handling of Git reference name resolution, which could allow an authenticated user to create a repository where the content shown in th...

PT-2026-56585

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.5 through 18.11.6 GitLab CE/EE versions 19.0 through 19.0.3 GitLab CE/EE versions 19.1 through 19.1.1 Description An issue exists where an authenticated user can create a repository where the content displayed in the w...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...

CVE-2026-22547

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

CVE-2026-22547

Gitea prior to version 1.25.5 exposes improper input validation during repository creation (fields such as template values and trust/model formats). The CVE description aligns with multiple advisories (Snyk for modules/structs, services/forms, and repository) indicating the root cause is insuffic...

CVE-2026-22547 Gitea repository creation accepts invalid field values

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

CVE-2026-22547 Gitea repository creation accepts invalid field values

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

EUVD-2026-41616

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

CVE-2026-22547

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

PT-2026-55589

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software lacks validation constraints for fields used during repository creation. This includes a lack of length limits for template fields and missing validation for trust model or object format...

GO-2026-5365 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea

Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration in code.gitea.io/gitea...