Export limit exceeded: 425740 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 87

Export CSV
CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58508

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58417

REST API exposes organization membership of private organizations to public

REST API exposes organization membership of private organizations to public

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58445

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58431

Public-only API token restriction is not enforced on team API routes

Public-only API token restriction is not enforced on team API routes

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-55987

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content

Cross-repository issue/comment attachment re-linking can expose private attachment content

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server