| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. |
| Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
| Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
| Private Repository Existence Disclosure via go-get Meta Endpoint |
| Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) |
| Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
| Repository Visibility Manipulation via Git Push Options |
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
| Local File Inclusion via file:// URI in Migration Restore |
| REST API exposes organization membership of private organizations to public |
| Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload |
| Gitea Remember-Me Token Theft Not Invalidating Attacker Session |
| Gitea SSH Key Parser Denial of Service |
| Privilege Escalation via Access Token Scope Escalation in API |
| Email Management API Bypasses ManageCredentials Feature Restrictions |
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
| vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact. |
| The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case. |
| Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant. |
| The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns. |
