22711 matches found
EUVD-2026-58171
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58442
The Gitea software is vulnerable to a Server-Side Request Forgery (SSRF) during repository migration. This issue stems from a multi-answer DNS allow-list bypass specifically identified in the gitea.dev component. The vulnerability allows an attacker to bypass security restrictions to perform SSRF...
EUVD-2026-58169
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58443
Public-only repository tokens can update private PR head branches...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
Repository migration SSRF via multi-answer DNS allow-list bypass...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58438
The Git repository management system Gitea is vulnerable to a cross-repository IDOR (Insecure Direct Object Reference) in the issue-dependency removal functionality. This flaw allows a malicious actor to tamper with and comment on private repositories they are not authorized to access. A proof-of...
CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437
The Git repository management system Gitea is affected by a vulnerability where an attacker can manipulate repository visibility settings by leveraging specific Git push options . This issue originates from a flaw in the HookPostReceive() function within the routers/private/hook_post_receive.go f...
EUVD-2026-58164
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58434
The Gitea repository management system is affected by a vulnerability where private repository metadata remains accessible even after access has been revoked. This issue can lead to the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea version 1.27.0 , wh...