179909 matches found
SUSE CVE-2026-57886
Cross-repository issue/comment attachment re-linking can expose private attachment content...
SUSE CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...
SUSE CVE-2026-57897
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
SUSE CVE-2026-58041
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...
SUSE CVE-2026-58042
A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
SUSE CVE-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
SUSE CVE-2026-58045
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...
SUSE CVE-2026-58196
unknown...
SUSE CVE-2026-58314
Two SSRF findings in Gitea 1.26.2...
SUSE CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
SUSE CVE-2026-58419
Notification API leaks private issue metadata after access revocation...
SUSE CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore...
SUSE CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...
SUSE CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass...
SUSE CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
SUSE CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...
SUSE CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
SUSE CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
SUSE CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked - ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...