Lucene search
+L

5584 matches found

Snyk
Snyk
•added 2026/07/21 9:52 p.m.•4 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the ToHook process. An attacker can access sensitive authorization credentials by making authorized API requests as a repository administrator. Remediation Upgrade...

6.9CVSS5.7AI score0.00387EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 9:16 p.m.•13 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the handling of outbound HTTP requests for webhooks, repository migration, and OpenID sign-in due to insufficient filtering of non-routable and internal IP address ranges. An attacker can access...

7.7CVSS8AI score0.00402EPSS
SaveExploits0References2
OSV
OSV
•added 2026/07/21 8:27 p.m.•10 views

GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

9.6CVSS7.6AI score0.00464EPSS
SaveExploits1References7
EUVD
EUVD
•added 2026/07/21 8:27 p.m.•22 views

EUVD-2026-41618

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter...

9.6CVSS7.7AI score0.00464EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
•added 2026/07/21 8:27 p.m.•19 views

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

9.6CVSS7.6AI score0.00464EPSS
SaveExploits1References7Affected Software1
OSV
OSV
•added 2026/07/21 8:11 p.m.•17 views

GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...

6.8CVSS5.5AI score0.00483EPSS
SaveExploits0References7
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•6 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•5 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•6 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•5 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•6 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•5 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•6 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•6 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•5 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/21 8:11 p.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

6.9CVSS7.8AI score0.00483EPSS
SaveExploits0References2
Rows per page
Query Builder