Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (87 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-55982 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 N/A
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
CVE-2026-55984 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 N/A
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
CVE-2026-55987 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 N/A
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
CVE-2026-57886 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 N/A
Cross-repository issue/comment attachment re-linking can expose private attachment content
CVE-2026-58416 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.1 High
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
CVE-2026-58507 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 N/A
Private Repository Existence Disclosure via go-get Meta Endpoint
CVE-2026-24059 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
CVE-2026-56657 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.2 Medium
Gitea SSH Key Parser Denial of Service
CVE-2026-58427 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58510 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 4.3 Medium
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
CVE-2026-42931 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.5 Medium
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVE-2026-55986 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-56750 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-50105 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-56443 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
CVE-2026-58434 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-59763 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 4.3 Medium
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
CVE-2026-58511 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 2.7 Low
Webhook Authorization Header Returned in Plaintext via API
CVE-2026-57897 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.5 Medium
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
CVE-2026-56755 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.2 Medium
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload