CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-58434

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59765

The Git repository management system Gitea (prior to version 1.27.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause involves the use of Go's default http.Get without a custom DialContext in HTTP fetch operations, specifically within migration and OAuth avatar code paths. ...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

EUVD-2026-58126

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint

Private Repository Existence Disclosure via go-get Meta Endpoint...

CVE-2026-58507

Gitea is vulnerable to a Private Repository Existence Disclosure via the go-get Meta Endpoint in gitea.dev. This flaw allows for the disclosure of whether private repositories exist on the server. Remediation is available in Gitea v1.27.0 , which contains fixes for 45 security issues, including i...

CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58434

The Gitea repository management system is affected by a vulnerability where private repository metadata remains accessible even after access has been revoked. This issue can lead to the exposure of sensitive information to unauthorized actors. Remediation is available in Gitea version 1.27.0 , wh...

EUVD-2026-58161

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation

Private Repository Metadata Remains Accessible After Access Revocation...

CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...

SUSE CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

JLSEC-2026-1307

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted...