Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-56654 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.8 Critical
Privilege Escalation via Access Token Scope Escalation in API
CVE-2026-56750 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 9.1 Critical
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
CVE-2026-58438 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
CVE-2026-58439 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 8.1 High
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-58440 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 6.8 Medium
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
CVE-2026-58437 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.1 High
Repository Visibility Manipulation via Git Push Options
CVE-2026-54481 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
CVE-2026-58427 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58428 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 6.5 Medium
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
CVE-2026-58436 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.5 High
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58416 1 Gitea 1 Gitea Open Source Git Server 2026-08-14 7.1 High
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
CVE-2026-20896 1 Gitea 1 Gitea Open Source Git Server 2026-07-07 9.8 Critical
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.