CVE Database
8818 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-70407 | MEDIUM | 4.3 | Gitea's organization-list API does not enforce the read:organization token scope. A token limited to… | — |
|
2026-10-14 |
| CVE-2026-70406 | MEDIUM | 6.5 | Gitea's shared comparison helper omits the token repository-access check used when updating pull req… | — |
|
2026-10-14 |
| CVE-2026-70402 | MEDIUM | 5.8 | Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process … | — |
|
2026-10-14 |
| CVE-2026-70400 | MEDIUM | 5.4 | Gitea's repository migration API accepts a public-only token when the request specifies creation of … | — |
|
2026-10-14 |
| CVE-2026-68964 | MEDIUM | 4.3 | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their w… | — |
|
2026-10-14 |
| CVE-2026-68957 | MEDIUM | 4.3 | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when ev… | — |
|
2026-10-14 |
| CVE-2026-67577 | MEDIUM | 4.3 | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility chec… | — |
|
2026-10-14 |
| CVE-2026-66874 | MEDIUM | 6.5 | For pull request events, Gitea reads workflow definitions from the pull request head and posts a syn… | — |
|
2026-10-14 |
| CVE-2026-66853 | MEDIUM | 4.3 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restr… | — |
|
2026-10-14 |
| CVE-2026-66849 | MEDIUM | 4.3 | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibil… | — |
|
2026-10-14 |
| CVE-2026-63792 | MEDIUM | 5.3 | Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does … | — |
|
2026-10-14 |
| CVE-2026-63021 | MEDIUM | 6.5 | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manife… | — |
|
2026-10-14 |
| CVE-2026-62925 | MEDIUM | 6.5 | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the deco… | — |
|
2026-10-14 |
| CVE-2026-60018 | MEDIUM | 6.5 | Gitea's OneDev migration downloader reads the entire remote version response into memory without a s… | — |
|
2026-10-14 |
| CVE-2026-60010 | MEDIUM | 6.5 | Gitea's repository-side team-link API allows a repository administrator who is not an organization o… | — |
|
2026-10-14 |
| CVE-2026-59766 | MEDIUM | 4.3 | Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permiss… | — |
|
2026-10-14 |
| CVE-2026-25946 | MEDIUM | 5.3 | When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requ… |
T1190
T1059
+1
|
|
2026-10-14 |
| CVE-2026-110630 | MEDIUM | 6.5 | VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user mana… | — |
|
2026-10-14 |
| CVE-2026-110629 | MEDIUM | 6.5 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows aut… |
T1190
T1203
|
|
2026-10-14 |
| CVE-2026-110627 | MEDIUM | 4.7 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_ar… |
T1190
T1203
|
|
2026-10-14 |