54762 matches found
SUSE CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
SUSE CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
SUSE CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore...
SUSE CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...
SUSE CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...
SUSE CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass...
SUSE CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
SUSE CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
SUSE CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
SUSE CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
SUSE CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked - ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
SUSE CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...
SUSE CVE-2026-58511
Webhook Authorization Header Returned in Plaintext via API...
SUSE CVE-2026-59763
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...
SUSE CVE-2026-59765
SSRF via Migration Asset Downloads Bypasses hostmatcher - Reads Internal Files and Cloud Metadata...
SUSE CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
SUSE CVE-2026-61632
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured basepath with...
SUSE CVE-2026-61699
nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay...
SUSE CVE-2026-62430
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked,...