Veille CVE

Août 2026

50 CVE

Critique 9 Élevée 15 Moyenne 22 Faible 4 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Gitea » ✕
  1. CVE-2026-60004 9.8 Critique Exploitée

    Gitea · Gitea gitea

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

  2. CVE-2026-59765 7.5 Élevée

    Gitea Open Source Git Server

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

  3. CVE-2026-59763 4.3 Moyenne

    Gitea Open Source Git Server

    Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

  4. CVE-2026-58511 2.7 Faible

    Gitea Open Source Git Server

    Webhook Authorization Header Returned in Plaintext via API

  5. CVE-2026-58510 4.3 Moyenne

    Gitea Open Source Git Server

    GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

  6. CVE-2026-58508 9.1 Critique

    Gitea Open Source Git Server

    Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

  7. CVE-2026-58507 5.3 Moyenne

    Gitea Open Source Git Server

    Private Repository Existence Disclosure via go-get Meta Endpoint

  8. CVE-2026-58445 2.7 Faible

    Gitea Open Source Git Server

    Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

  9. CVE-2026-58444 4.3 Moyenne

    Gitea Open Source Git Server

    Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

  10. CVE-2026-58443 9.1 Critique

    Gitea Open Source Git Server

    Public-only repository tokens can update private PR head branches

  11. CVE-2026-58442 6.5 Moyenne

    Gitea Open Source Git Server

    Repository migration SSRF via multi-answer DNS allow-list bypass

  12. CVE-2026-58441 6.3 Moyenne

    Gitea Open Source Git Server

    SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

  13. CVE-2026-58440 6.8 Moyenne

    Gitea Open Source Git Server

    Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)

  14. CVE-2026-58439 8.1 Élevée

    Gitea Open Source Git Server

    Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

  15. CVE-2026-58438 7.5 Élevée

    Gitea Open Source Git Server

    Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  16. CVE-2026-58437 7.1 Élevée

    Gitea Open Source Git Server

    Repository Visibility Manipulation via Git Push Options

  17. CVE-2026-58436 7.5 Élevée

    Gitea Open Source Git Server

    ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

  18. CVE-2026-58435 5.4 Moyenne

    Gitea Open Source Git Server

    Gitea LFS Deploy-Key Privilege Escalation

  19. CVE-2026-58434 7.5 Élevée

    Gitea Open Source Git Server

    Private Repository Metadata Remains Accessible After Access Revocation

  20. CVE-2026-58433 9.1 Critique

    Gitea Open Source Git Server

    Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

  21. CVE-2026-58432 5.9 Moyenne

    Gitea Open Source Git Server

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  22. CVE-2026-58431 4.3 Moyenne

    Gitea Open Source Git Server

    Public-only API token restriction is not enforced on team API routes

  23. CVE-2026-58429 4.9 Moyenne

    Gitea Open Source Git Server

    Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

  24. CVE-2026-58428 6.5 Moyenne

    Gitea Open Source Git Server

    Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

  25. CVE-2026-58427 7.5 Élevée

    Gitea Open Source Git Server

    Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

  26. CVE-2026-58425 4.3 Moyenne

    Gitea Open Source Git Server

    OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

  27. CVE-2026-58420 4.4 Moyenne

    Gitea Open Source Git Server

    Local File Inclusion via file:// URI in Migration Restore

  28. CVE-2026-58417 7.5 Élevée

    Gitea Open Source Git Server

    REST API exposes organization membership of private organizations to public

  29. CVE-2026-58416 7.1 Élevée

    Gitea Open Source Git Server

    Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

  30. CVE-2026-58314 7.7 Élevée

    Gitea Open Source Git Server

    Two SSRF findings in Gitea 1.26.2

  31. CVE-2026-57897 6.5 Moyenne

    Gitea Open Source Git Server

    Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

  32. CVE-2026-57894 8.5 Élevée

    Gitea Open Source Git Server

    Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

  33. CVE-2026-57886 5.9 Moyenne

    Gitea Open Source Git Server

    Cross-repository issue/comment attachment re-linking can expose private attachment content

  34. CVE-2026-56755 6.2 Moyenne

    Gitea Open Source Git Server

    Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

  35. CVE-2026-56750 9.1 Critique

    Gitea Open Source Git Server

    Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  36. CVE-2026-56657 6.2 Moyenne

    Gitea Open Source Git Server

    Gitea SSH Key Parser Denial of Service

  37. CVE-2026-56654 9.8 Critique

    Gitea Open Source Git Server

    Privilege Escalation via Access Token Scope Escalation in API

  38. CVE-2026-56443 9.6 Critique

    Gitea Open Source Git Server

    Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  39. CVE-2026-55987 8.1 Élevée

    Gitea Open Source Git Server

    OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

  40. CVE-2026-55986 5.4 Moyenne

    Gitea Open Source Git Server

    Email Management API Bypasses ManageCredentials Feature Restrictions

  41. CVE-2026-55984 2.7 Faible

    Gitea Open Source Git Server

    Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

  42. CVE-2026-55982 9.1 Critique

    Gitea Open Source Git Server

    OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  43. CVE-2026-54481 7.5 Élevée

    Gitea Open Source Git Server

    Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

  44. CVE-2026-50105 4.3 Moyenne

    Gitea Open Source Git Server

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  45. CVE-2026-42931 6.5 Moyenne

    Gitea Open Source Git Server

    Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

  46. CVE-2026-24791 8.1 Élevée

    Gitea Open Source Git Server

    Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

  47. CVE-2026-24059 6.5 Moyenne

    Gitea Open Source Git Server

    The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

  48. CVE-2026-23603 3.1 Faible

    Gitea Open Source Git Server

    Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

  49. CVE-2026-72867 9.9 Critique

    dokploy

    Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trigger compose.deploy, which passes the stored branch to shell-based Git clone commands in packages/server/src/utils/providers/git.ts, github.ts, gitlab.ts, bitbucket.ts, and gitea.ts, resulting in arbitrary host command execution. This issue is fixed in version 0.29.13.

  50. CVE-2026-34966 7.6 Élevée

    Gitea

    Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.