Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
47882
Total
3850
Critical
14243
High
13921
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-58425 | UNKNOWN | — | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | Aug 13, 2026 |
| CVE-2026-58420 | UNKNOWN | — | Local File Inclusion via file:// URI in Migration Restore | Aug 13, 2026 |
| CVE-2026-58417 | UNKNOWN | — | REST API exposes organization membership of private organizations to public | Aug 13, 2026 |
| CVE-2026-58416 | HIGH | 7.1 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | Aug 13, 2026 |
| CVE-2026-58314 | UNKNOWN | — | Two SSRF findings in Gitea 1.26.2 | Aug 13, 2026 |
| CVE-2026-57897 | MEDIUM | 6.5 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | Aug 13, 2026 |
| CVE-2026-57894 | UNKNOWN | — | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | Aug 13, 2026 |
| CVE-2026-57886 | UNKNOWN | — | Cross-repository issue/comment attachment re-linking can expose private attachment content | Aug 13, 2026 |
| CVE-2026-56755 | MEDIUM | 6.2 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | Aug 13, 2026 |
| CVE-2026-56750 | UNKNOWN | — | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | Aug 13, 2026 |
| CVE-2026-56657 | MEDIUM | 6.2 | Gitea SSH Key Parser Denial of Service | Aug 13, 2026 |
| CVE-2026-56654 | UNKNOWN | — | Privilege Escalation via Access Token Scope Escalation in API | Aug 13, 2026 |
| CVE-2026-56443 | UNKNOWN | — | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | Aug 13, 2026 |
| CVE-2026-55987 | UNKNOWN | — | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | Aug 13, 2026 |
| CVE-2026-55986 | UNKNOWN | — | Email Management API Bypasses ManageCredentials Feature Restrictions | Aug 13, 2026 |
| CVE-2026-55984 | UNKNOWN | — | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | Aug 13, 2026 |
| CVE-2026-55982 | UNKNOWN | — | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | Aug 13, 2026 |
| CVE-2026-55402 | UNKNOWN | — | CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send … | Aug 13, 2026 |
| CVE-2026-54481 | UNKNOWN | — | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | Aug 13, 2026 |
| CVE-2026-50105 | UNKNOWN | — | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | Aug 13, 2026 |
| CVE-2026-42931 | MEDIUM | 6.5 | Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | Aug 13, 2026 |
| CVE-2026-24791 | HIGH | 8.1 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | Aug 13, 2026 |
| CVE-2026-24059 | UNKNOWN | — | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies … | Aug 13, 2026 |
| CVE-2026-23603 | UNKNOWN | — | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | Aug 13, 2026 |
| CVE-2026-13051 | UNKNOWN | — | Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error … | Aug 13, 2026 |