54607 matches found
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...
GHSA-FQ2P-5P22-8G6J Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...
Improper Restriction of Security Token Assignment
Overview Affected versions of this package are vulnerable to Improper Restriction of Security Token Assignment in the organization and permission endpoints when a personal access token is restricted to public-only scope. An attacker can access private organization membership and authorization...
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public...
Server-side Request Forgery (SSRF)
Overview code.gitea.io/gitea/services/migrations is a painless self-hosted Git Service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access...
EUVD-2026-41636
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...
EUVD-2026-46401
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...
CVE-2026-63358
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...
CVE-2026-47237
CVE-2026-47237 affects Kubeflow Community Distribution prior to version 26.03-rc.1. A Kubeflow setup based on official manifests or most packaged distributions is vulnerable to authorization token stealing from any Kubeflow UI/API user (Dashboard, Pipelines API, Notebooks). An attacker with kubef...
CVE-2026-47237 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
CVE-2026-47237 Kubeflow Community Distribution: Overly Permissive Istio Permissions Allows Kubeflow Authorization Token Stealing
Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Summary GetActionsUserRepoPermission models/perm/access/repopermission.go decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — except the collaborative-owner branch, which is missing the !task.IsForkPullRequest guard that i...
GHSA-RJVX-X5H2-6PX5 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
Summary The API endpoint used to fork repositories into organizations performs a weaker authorization check than the corresponding web UI and other repository creation endpoints. When a repository is forked into an organization through the API, the endpoint only verifies that the user is an...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...
CVE-2026-63358 FileGator privilege escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...
CVE-2026-63358 FileGator privilege escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...