Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (136 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-24059 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
CVE-2026-56657 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.2 Medium
Gitea SSH Key Parser Denial of Service
CVE-2026-58427 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58510 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 4.3 Medium
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
CVE-2026-42931 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.5 Medium
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
CVE-2026-55986 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Email Management API Bypasses ManageCredentials Feature Restrictions
CVE-2026-56750 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-50105 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-56443 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
CVE-2026-58434 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-59763 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 4.3 Medium
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
CVE-2026-58511 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 2.7 Low
Webhook Authorization Header Returned in Plaintext via API
CVE-2026-57897 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.5 Medium
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
CVE-2026-56755 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 6.2 Medium
Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
CVE-2026-24791 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 8.1 High
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
CVE-2026-58437 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Repository Visibility Manipulation via Git Push Options
CVE-2026-58439 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-23603 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
CVE-2026-56654 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-58443 1 Gitea 1 Gitea Open Source Git Server 2026-08-13 N/A
Public-only repository tokens can update private PR head branches