CVE-2026-58508

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58441

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-46382

A flaw was found in the Meeting Room Booking System MRBS. This vulnerability, known as Server-Side Request Forgery SSRF, allows a remote attacker to trick the server into making requests to internal or local network resources. By exploiting this, an attacker could potentially gain unauthorized...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59765

CVE-2026-59765 is a Gitea SSRF vulnerability: prior to version 1.27.0, the Migration Asset Downloads path can bypass hostmatcher, enabling server-side requests that reach internal files and cloud metadata. Root cause involves how migration/OAuth paths perform HTTP fetches (Go http.Get usage) allo...

CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58508

Technical details (affected product/component, root cause, impact, and exploitation specifics) are not publicly available in the provided documents. Monitor for official disclosures and updates.

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58442

CVE-2026-58442 affects Gitea and is described as a repository migration SSRF through a multi-answer DNS allow‑list bypass. The root cause is an allow‑list bypass during repository migrations that could enable SSRF to internal destinations. The CVSS 3.1 data indicates a medium base score (6.5) wit...

CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441

CVE-2026-58441 : Gitea exposes an SSRF vulnerability in the restore-repo feature via an unsanitized pull_request.yml Head.CloneURL. The issue is triggered when the application processes a repository pull_request configuration, allowing an attacker with limited access to induce the server to fetch...