Veille CVE

Jeudi 13 août 2026

62 CVE

Critique 7 Élevée 23 Moyenne 28 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « git » ✕
  1. CVE-2026-72687 6.5 Moyenne

    Elasticsearch · Elastic elasticsearch

    A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

  2. CVE-2026-18428 8.8 Élevée

    AWS Opensearch · Github Opensearch

    A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

  3. CVE-2026-59765 7.5 Élevée

    Gitea Open Source Git Server

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

  4. CVE-2026-59763 4.3 Moyenne

    Gitea Open Source Git Server

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

  5. CVE-2026-58511 2.7 Faible

    Gitea Open Source Git Server

    Webhook Authorization Header Returned in Plaintext via API

  6. CVE-2026-58510 4.3 Moyenne

    Gitea Open Source Git Server

    GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

  7. CVE-2026-58508 9.1 Critique

    Gitea Open Source Git Server

    Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

  8. CVE-2026-58507 5.3 Moyenne

    Gitea Open Source Git Server

    Private Repository Existence Disclosure via go-get Meta Endpoint

  9. CVE-2026-58445 2.7 Faible

    Gitea Open Source Git Server

    Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

  10. CVE-2026-58444 4.3 Moyenne

    Gitea Open Source Git Server

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

  11. CVE-2026-58443 9.1 Critique

    Gitea Open Source Git Server

    Public-only repository tokens can update private PR head branches

  12. CVE-2026-58442 6.5 Moyenne

    Gitea Open Source Git Server

    Repository migration SSRF via multi-answer DNS allow-list bypass

  13. CVE-2026-58441 6.3 Moyenne

    Gitea Open Source Git Server

    SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

  14. CVE-2026-58440 6.8 Moyenne

    Gitea Open Source Git Server

    Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

  15. CVE-2026-58439 8.1 Élevée

    Gitea Open Source Git Server

    Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

  16. CVE-2026-58438 7.5 Élevée

    Gitea Open Source Git Server

    Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  17. CVE-2026-58437 7.1 Élevée

    Gitea Open Source Git Server

    Repository Visibility Manipulation via Git Push Options

  18. CVE-2026-58436 7.5 Élevée

    Gitea Open Source Git Server

    ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

  19. CVE-2026-58435 5.4 Moyenne

    Gitea Open Source Git Server

    Gitea LFS Deploy-Key Privilege Escalation

  20. CVE-2026-58434 7.5 Élevée

    Gitea Open Source Git Server

    Private Repository Metadata Remains Accessible After Access Revocation

  21. CVE-2026-58433 9.1 Critique

    Gitea Open Source Git Server

    Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

  22. CVE-2026-58432 5.9 Moyenne

    Gitea Open Source Git Server

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  23. CVE-2026-58431 4.3 Moyenne

    Gitea Open Source Git Server

    Public-only API token restriction is not enforced on team API routes

  24. CVE-2026-58429 4.9 Moyenne

    Gitea Open Source Git Server

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

  25. CVE-2026-58428 6.5 Moyenne

    Gitea Open Source Git Server

    Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

  26. CVE-2026-58427 7.5 Élevée

    Gitea Open Source Git Server

    Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  27. CVE-2026-58425 4.3 Moyenne

    Gitea Open Source Git Server

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

  28. CVE-2026-58420 4.4 Moyenne

    Gitea Open Source Git Server

    Local File Inclusion via file:// URI in Migration Restore

  29. CVE-2026-58417 7.5 Élevée

    Gitea Open Source Git Server

    REST API exposes organization membership of private organizations to public

  30. CVE-2026-58416 7.1 Élevée

    Gitea Open Source Git Server

    Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  31. CVE-2026-58314 7.7 Élevée

    Gitea Open Source Git Server

    Two SSRF findings in Gitea 1.26.2

  32. CVE-2026-57897 6.5 Moyenne

    Gitea Open Source Git Server

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

  33. CVE-2026-57894 8.5 Élevée

    Gitea Open Source Git Server

    Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

  34. CVE-2026-57886 5.9 Moyenne

    Gitea Open Source Git Server

    Cross-repository issue/comment attachment re-linking can expose private attachment content

  35. CVE-2026-56755 6.2 Moyenne

    Gitea Open Source Git Server

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

  36. CVE-2026-56750 9.1 Critique

    Gitea Open Source Git Server

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  37. CVE-2026-56657 6.2 Moyenne

    Gitea Open Source Git Server

    Gitea SSH Key Parser Denial of Service

  38. CVE-2026-56654 9.8 Critique

    Gitea Open Source Git Server

    Privilege Escalation via Access Token Scope Escalation in API

  39. CVE-2026-56443 9.6 Critique

    Gitea Open Source Git Server

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  40. CVE-2026-55987 8.1 Élevée

    Gitea Open Source Git Server

    OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  41. CVE-2026-55986 5.4 Moyenne

    Gitea Open Source Git Server

    Email Management API Bypasses ManageCredentials Feature Restrictions

  42. CVE-2026-55984 2.7 Faible

    Gitea Open Source Git Server

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

  43. CVE-2026-55982 9.1 Critique

    Gitea Open Source Git Server

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  44. CVE-2026-54481 7.5 Élevée

    Gitea Open Source Git Server

    Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

  45. CVE-2026-50105 4.3 Moyenne

    Gitea Open Source Git Server

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  46. CVE-2026-42931 6.5 Moyenne

    Gitea Open Source Git Server

    Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

  47. CVE-2026-24791 8.1 Élevée

    Gitea Open Source Git Server

    Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

  48. CVE-2026-24059 6.5 Moyenne

    Gitea Open Source Git Server

    The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

  49. CVE-2026-23603 3.1 Faible

    Gitea Open Source Git Server

    Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

  50. CVE-2026-73506 6.1 Moyenne

    JanDeDobbeleer oh-my-posh

    Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.

  51. CVE-2026-70464 7.5 Élevée

    RsyncProject rsync

    rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

  52. CVE-2026-53788 6.5 Moyenne

    RsyncProject rsync

    rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

  53. CVE-2026-19292 8.8 Élevée

    silabs.com WiseConnect

    Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

  54. CVE-2026-14671 8.8 Élevée

    PostgreSQL · Postgresql postgresql

    Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

  55. CVE-2026-73625 8.8 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

  56. CVE-2026-73624 8.1 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

  57. CVE-2026-73623 8.8 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

  58. CVE-2026-73622 7.5 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

  59. CVE-2026-73621 5.4 Moyenne

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).

  60. CVE-2026-73620 8.1 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

  61. CVE-2026-73619 6.5 Moyenne

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

  62. CVE-2026-71194 6.8 Moyenne

    OpenStack Designate

    In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration.