Threat database

92 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.5%	CVE-2026-58438Gitea Open Source Git Server · CWE-862 High7.5EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access EPSS 0.5%Vulnerability Gitea #ghsa-xv9x-fj9g-vj6h #go #cwe-862	GCVE Database	2026-07-22
Medium	6.3	EPSS 0.2%	CVE-2026-58441Gitea Open Source Git Server · CWE-918 Medium6.3EPSS 0.2%2026-07-22GCVE DatabaseCVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL EPSS 0.2%Vulnerability Gitea #ghsa-xmj7-xj85-hfc3 #go #cwe-918	GCVE Database	2026-07-22
Medium	6.5	EPSS 0.4%	CVE-2026-58442Gitea Open Source Git Server · CWE-200 Medium6.5EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass EPSS 0.4%Vulnerability Gitea #ghsa-h2x6-g7q6-344v #go #cwe-200	GCVE Database	2026-07-22
Critical	9.1	EPSS 0.6%	CVE-2026-58443Gitea Open Source Git Server · CWE-863 Critical9.1EPSS 0.6%2026-07-22GCVE DatabaseCVE-2026-58443 Public-only repository tokens can update private PR head branches EPSS 0.6%Vulnerability Gitea #ghsa-xxjv-752h-3vp2 #go #cwe-863	GCVE Database	2026-07-22
Medium	4.3	EPSS 0.4%	CVE-2026-58444Gitea Open Source Git Server · CWE-863 Medium4.3EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents EPSS 0.4%Vulnerability Gitea #ghsa-cp3q-vrj2-ghhh #go #cwe-863	GCVE Database	2026-07-22
Low	2.7	EPSS 0.4%	CVE-2026-58445Gitea Open Source Git Server · CWE-203 Low2.7EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API EPSS 0.4%Vulnerability Gitea #ghsa-pgqf-926r-548m #go #cwe-203	GCVE Database	2026-07-22
Medium	4.3	EPSS 0.4%	CVE-2026-50105Gitea Open Source Git Server · CWE-200 Medium4.3EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) EPSS 0.4%Vulnerability Gitea #ghsa-6cqf-375w-639g #go #cwe-200	GCVE Database	2026-07-22
High	7.5	EPSS 0.5%	CVE-2026-58417Gitea Open Source Git Server · CWE-284 High7.5EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-58417 REST API exposes organization membership of private organizations to public EPSS 0.5%Vulnerability Gitea #ghsa-jr5x-6h83-wrxf #go #cwe-284	GCVE Database	2026-07-22
High	7.5	EPSS 0.3%	CVE-2026-54481Gitea Open Source Git Server · CWE-295 High7.5EPSS 0.3%2026-07-22GCVE DatabaseCVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) EPSS 0.3%Vulnerability Gitea #ghsa-94v3-77j7-vm48 #go #cwe-295	GCVE Database	2026-07-22
High	7.5	EPSS 0.5%	CVE-2026-58434Gitea Open Source Git Server · CWE-200 High7.5EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation EPSS 0.5%Vulnerability Gitea #ghsa-j2w3-9c3r-g83q #go #cwe-200	GCVE Database	2026-07-22
Critical	9.1	EPSS 0.5%	CVE-2026-55982Gitea Open Source Git Server · CWE-200 Critical9.1EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes EPSS 0.5%Vulnerability Gitea #ghsa-mg4f-x9v4-6h2p #go #cwe-200	GCVE Database	2026-07-22
Low	2.7	EPSS 0.5%	CVE-2026-55984Gitea Open Source Git Server · CWE-284 Low2.7EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service EPSS 0.5%Vulnerability Gitea #ghsa-m932-crvm-gcp5 #go #cwe-284	GCVE Database	2026-07-22
Medium	4.4	EPSS 0.5%	CVE-2026-58420Gitea Open Source Git Server · CWE-284 Medium4.4EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore EPSS 0.5%Vulnerability Gitea #ghsa-5ggr-2f2h-jmvm #go #cwe-284	GCVE Database	2026-07-22
Medium	5.4	EPSS 0.3%	CVE-2026-58435Gitea Open Source Git Server · CWE-266 Medium5.4EPSS 0.3%2026-07-22GCVE DatabaseCVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation EPSS 0.3%Vulnerability Gitea #ghsa-rh79-75qm-gwjr #go #cwe-266	GCVE Database	2026-07-22
High	8.1	EPSS 0.4%	CVE-2026-55987Gitea Open Source Git Server · CWE-863 High8.1EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) EPSS 0.4%Vulnerability Gitea #ghsa-vrhc-jjfc-m3m3 #go #cwe-863	GCVE Database	2026-07-22
High	7.1	EPSS 0.3%	CVE-2026-58437Gitea Open Source Git Server · CWE-284 High7.1EPSS 0.3%2026-07-22GCVE DatabaseCVE-2026-58437 Repository Visibility Manipulation via Git Push Options EPSS 0.3%Vulnerability Gitea #ghsa-8p9h-49rc-qgxj #go #cwe-284	GCVE Database	2026-07-22
High	7.5	EPSS 0.6%	CVE-2026-58436Gitea Open Source Git Server · CWE-407 High7.5EPSS 0.6%2026-07-22GCVE DatabaseCVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests EPSS 0.6%Vulnerability Gitea #ghsa-fw57-jgch-pgf3 #go #cwe-407	GCVE Database	2026-07-22
High	7.7	EPSS 0.4%	CVE-2026-58314Gitea Open Source Git Server · CWE-918 High7.7EPSS 0.4%2026-07-22GCVE DatabaseCVE-2026-58314 Two SSRF findings in Gitea 1.26.2 EPSS 0.4%Vulnerability Gitea #ghsa-2fcr-jfvc-vgg2 #go #cwe-918	GCVE Database	2026-07-22
High	7.5	EPSS 0.5%	CVE-2026-58427Gitea Open Source Git Server · CWE-200 High7.5EPSS 0.5%2026-07-22GCVE DatabaseCVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 EPSS 0.5%Vulnerability Gitea #ghsa-prr9-9mp4-5gp2 #go #cwe-200	GCVE Database	2026-07-22
Medium	4.3	EPSS 0.3%	CVE-2026-58431Gitea Open Source Git Server · CWE-863 Medium4.3EPSS 0.3%2026-07-22GCVE DatabaseCVE-2026-58431 Public-only API token restriction is not enforced on team API routes EPSS 0.3%Vulnerability Gitea #ghsa-h56g-4qw7-2mxg #go #cwe-863	GCVE Database	2026-07-22

Showing 21–40 of 92 results