Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (87 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-59765 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
CVE-2026-58443 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.1 Critical
Public-only repository tokens can update private PR head branches
CVE-2026-58442 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 6.5 Medium
Repository migration SSRF via multi-answer DNS allow-list bypass
CVE-2026-58441 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 6.3 Medium
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
CVE-2026-58433 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.1 Critical
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
CVE-2026-58432 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 5.9 Medium
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
CVE-2026-56443 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.6 Critical
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
CVE-2026-58314 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.7 High
Two SSRF findings in Gitea 1.26.2
CVE-2026-58434 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-50105 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 4.3 Medium
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-54481 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
CVE-2026-55982 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.1 Critical
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-55984 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 2.7 Low
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
CVE-2026-58427 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58429 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 4.9 Medium
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
CVE-2026-55986 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 5.4 Medium
Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-24059 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 6.5 Medium
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
CVE-2026-23603 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 3.1 Low
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
CVE-2026-58416 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.1 High
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
CVE-2026-56657 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.2 Medium
Gitea SSH Key Parser Denial of Service