| CVE-2026-24059 |
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents)…
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-24791 |
Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
|
8.1
High
|
Aug 13, 2026 |
| CVE-2026-59765 |
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58510 |
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on…
|
4.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58511 |
Webhook Authorization Header Returned in Plaintext via API
|
2.7
Low
|
Aug 13, 2026 |
| CVE-2026-59763 |
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
|
4.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58507 |
Private Repository Existence Disclosure via go-get Meta Endpoint
|
5.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58508 |
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58444 |
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private…
|
4.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58445 |
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
|
2.7
Low
|
Aug 13, 2026 |
| CVE-2026-58442 |
Repository migration SSRF via multi-answer DNS allow-list bypass
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-58443 |
Public-only repository tokens can update private PR head branches
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58440 |
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of…
|
6.8
Medium
|
Aug 13, 2026 |
| CVE-2026-58441 |
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
|
6.3
Medium
|
Aug 13, 2026 |
| CVE-2026-58438 |
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they…
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58439 |
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
|
8.1
High
|
Aug 13, 2026 |
| CVE-2026-58436 |
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58437 |
Repository Visibility Manipulation via Git Push Options
|
7.1
High
|
Aug 13, 2026 |
| CVE-2026-58434 |
Private Repository Metadata Remains Accessible After Access Revocation
|
7.5
High
|
Aug 13, 2026 |
| CVE-2026-58435 |
Gitea LFS Deploy-Key Privilege Escalation
|
5.4
Medium
|
Aug 13, 2026 |
| CVE-2026-58432 |
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for…
|
5.9
Medium
|
Aug 13, 2026 |
| CVE-2026-58433 |
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
|
9.1
Critical
|
Aug 13, 2026 |
| CVE-2026-58428 |
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
|
6.5
Medium
|
Aug 13, 2026 |
| CVE-2026-58429 |
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
|
4.9
Medium
|
Aug 13, 2026 |
| CVE-2026-58431 |
Public-only API token restriction is not enforced on team API routes
|
4.3
Medium
|
Aug 13, 2026 |