10 matches found
EUVD-2026-93922
With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...
CVE-2026-96400
With "migrations ALLOWEDDOMAINS" set to a matching entry such as "" or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as "169.254.169.254", even when "ALLOWLOCALNETWORKS = false". The local-network block list did not cover these ranges,...
CVE-2026-96400: Server-Side Request Forgery (SSRF)
With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...
PT-2026-107224
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description URL validation during migrations may allow access to reserved and link-local addresses, such as 169.254.169.254, when the migrations ALLOWED DOMAINS configuration is set to a wildcard or a...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration and mirror synchronization process. An attacker can access internal Git repositories and exfiltrate sensitive data by submitting a crafted migration URL that causes the server...
NPM: NocoDB: Server-Side Request Forgery via Base Migration URL
NPM: NocoDB: Server-Side Request Forgery via Base Migration URL vulnerability discovered by ? in WordPress Npm nocodb versions = 0.301.3...