Veille CVE

Jeudi 13 août 2026

14 CVE sur 47

Critique 7 Élevée 14 Moyenne 22 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Gitea » ✕
  1. CVE-2026-59765 7.5 Élevée

    Gitea Open Source Git Server

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

  2. CVE-2026-58439 8.1 Élevée

    Gitea Open Source Git Server

    Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

  3. CVE-2026-58438 7.5 Élevée

    Gitea Open Source Git Server

    Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  4. CVE-2026-58437 7.1 Élevée

    Gitea Open Source Git Server

    Repository Visibility Manipulation via Git Push Options

  5. CVE-2026-58436 7.5 Élevée

    Gitea Open Source Git Server

    ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

  6. CVE-2026-58434 7.5 Élevée

    Gitea Open Source Git Server

    Private Repository Metadata Remains Accessible After Access Revocation

  7. CVE-2026-58427 7.5 Élevée

    Gitea Open Source Git Server

    Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  8. CVE-2026-58417 7.5 Élevée

    Gitea Open Source Git Server

    REST API exposes organization membership of private organizations to public

  9. CVE-2026-58416 7.1 Élevée

    Gitea Open Source Git Server

    Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  10. CVE-2026-58314 7.7 Élevée

    Gitea Open Source Git Server

    Two SSRF findings in Gitea 1.26.2

  11. CVE-2026-57894 8.5 Élevée

    Gitea Open Source Git Server

    Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

  12. CVE-2026-55987 8.1 Élevée

    Gitea Open Source Git Server

    OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  13. CVE-2026-54481 7.5 Élevée

    Gitea Open Source Git Server

    Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

  14. CVE-2026-24791 8.1 Élevée

    Gitea Open Source Git Server

    Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes