44923 matches found
Insertion of Sensitive Information Into Sent Data
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /login/oauth/userinfo endpoint. An attacker can access identity claims such as email and groups by supplying a personal access token with insufficient scopes as a bearer...
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...
Gitea: Private Repository Metadata Remains Accessible After Access Revocation
Summary A user who previously had access to a private repository can continue to obtain repository metadata through GET /api/v1/user/starred after their access to the repository has been revoked. After a collaborator is removed from a private repository, direct access to the repository is correct...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/v1/user/starred and GET /api/v1/user/subscriptions endpoints. An attacker can access repository metadata, such as repository name, description, and visibility status, by querying these endpoints...
Gitea: REST API exposes organization membership of private organizations to public
Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...
GHSA-JR5X-6H83-WRXF Gitea: REST API exposes organization membership of private organizations to public
Summary The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization. PoC 1. Spin up the nightly container of Gitea. 2. Perform the default installation. 3. Register a new user let's call this user "user1". 4. Create a new...
CVE-2026-47688
FOGProject vulnerability CVE-2026-47688 affects the FOGPage in FOG software. Before versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods can be invoked unauthenticated via a single HTTP GET to the public client node endpoint, enabling remote wiping of host AES encryptio...
EUVD-2026-46415
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...
CVE-2026-65054
Affected software: MediaCMS 8.2.0. Vulnerability: Information disclosure via playlist ownership loophole. Authenticated users can expose private media metadata belonging to other users by bypassing access controls when manipulating their own playlists. Root cause / trigger: Attacker issues a PUT ...
CVE-2026-64822 djangoSIGE 1.10 User Enumeration via ForgotPasswordView
djangoSIGE through 1.10 commit a6fe7e8 contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can...
GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...
GHSA-RJVX-X5H2-6PX5 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerability is in the Remember-Me giteaincredible token validation logic, specifically when handling a compromised token hash mismatch. The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/authtoken.goL33-L64...
CVE-2026-64878
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...