CVE-2026-77573 Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

EUVD-2026-58170

Public-only repository tokens can update private PR head branches...

CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

EUVD-2026-58165

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58416

The Gitea git repository management system contains a vulnerability in the Fork-PR Actions task where it can be exploited to read data from a third private repository. This is caused by a missing guard preventing unauthorized access via the collaborative-owner branch . A remote attacker could lev...

SUSE CVE-2026-58423

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the org-level Actions REST API endpoints, which lack per-repository access control checks. An attacker can access sensitive workflow metadata from private repositories by sending authenticated requests as an...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the RSS/Atom feed handlers, which accept API-token Basic authentication but do not enforce token scope or public-only restrictions. An attacker can access private repository metadata, such as commit information,...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the GetActionsUserRepoPermission function. An attacker can gain unauthorized read access to the contents of a private repository by exploiting a missing permission check when a collaborative owner is configur...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getStarredRepos and ListMyTrackedTimes functions. An attacker can access private repository metadata and private issue titles after their access has been revoked by sending requests to the affected API...

CVE-2026-52812

CVE-2026-52812 affects Gogs (open source self-hosted Git service) prior to 0.14.3. The vulnerability stems from a dedupe path in LFS storage: when an OID file already exists on disk, serveUpload bypasses hash verification and inserts a new per-repo binding (repo_id, oid) without confirming that t...

Malicious code in create-docs-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4381fd77419441a2eefe6b22adef6c9f5adfe1b92be5d071abd5908fdf8647 Package is published at version 9999.99.99 — the canonical high-version override used in dependency-confusion attacks against private/internal packag...

CVE-2021-22865

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed access tokens generated from a GitHub App's web authentication flow to read private repository metadata via the REST API without having been granted the appropriate permissions. To exploit this...

CVE-2025-8447

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the...

CVE-2021-22167

An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository...