Search
616 CVEs · published 2026-08-13 to 2026-08-13
CVEs (616, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 616 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-58432 | MEDIUM | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information t… | |
| CVE-2026-58431 | MEDIUM | 4.3 | 2026-08-13 | Public-only API token restriction is not enforced on team API routes | |
| CVE-2026-58429 | MEDIUM | 4.9 | 2026-08-13 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | |
| CVE-2026-58428 | MEDIUM | 6.5 | 2026-08-13 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | |
| CVE-2026-58427 | HIGH | 7.5 | 2026-08-13 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | |
| CVE-2026-58425 | MEDIUM | 4.3 | 2026-08-13 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | |
| CVE-2026-58420 | MEDIUM | 4.4 | 2026-08-13 | Local File Inclusion via file:// URI in Migration Restore | |
| CVE-2026-58417 | HIGH | 7.5 | 2026-08-13 | REST API exposes organization membership of private organizations to public | |
| CVE-2026-58416 | HIGH | 7.1 | 2026-08-13 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | |
| CVE-2026-58314 | HIGH | 7.7 | 2026-08-13 | Two SSRF findings in Gitea 1.26.2 | |
| CVE-2026-57897 | MEDIUM | 6.5 | 2026-08-13 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | |
| CVE-2026-57894 | HIGH | 8.5 | 2026-08-13 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | |
| CVE-2026-57886 | MEDIUM | 5.9 | 2026-08-13 | Cross-repository issue/comment attachment re-linking can expose private attachment content | |
| CVE-2026-56755 | MEDIUM | 6.2 | 2026-08-13 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | |
| CVE-2026-56750 | CRITICAL | 9.1 | 2026-08-13 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | |
| CVE-2026-56657 | MEDIUM | 6.2 | 2026-08-13 | Gitea SSH Key Parser Denial of Service | |
| CVE-2026-56654 | CRITICAL | 9.8 | 2026-08-13 | Privilege Escalation via Access Token Scope Escalation in API | |
| CVE-2026-56443 | CRITICAL | 9.6 | 2026-08-13 | Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | |
| CVE-2026-55987 | HIGH | 8.1 | 2026-08-13 | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | |
| CVE-2026-55986 | MEDIUM | 5.4 | 2026-08-13 | Email Management API Bypasses ManageCredentials Feature Restrictions | |
| CVE-2026-55984 | LOW | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | |
| CVE-2026-55982 | CRITICAL | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | |
| CVE-2026-55402 | NONE | — | 2026-08-13 | CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially craft… | |
| CVE-2026-54481 | HIGH | 7.5 | 2026-08-13 | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | |
| CVE-2026-50105 | MEDIUM | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |