CVE-2026-23603 LOW 3.1 Gitea Open Source Git Server — Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim● PoC 2026-08-13 CVE-2026-24059 MEDIUM 6.5 Gitea Open Source Git Server — The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivale… 2026-08-13 CVE-2026-24791 HIGH 8.1 Gitea Open Source Git Server — Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes● PoC 2026-08-13 CVE-2026-42931 MEDIUM 6.5 Gitea Open Source Git Server — Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint 2026-08-13 CVE-2026-50105 MEDIUM 4.3 Gitea Open Source Git Server — RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)● PoC 2026-08-13 CVE-2026-54481 HIGH 7.5 Gitea Open Source Git Server — Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)● PoC 2026-08-13 CVE-2026-55982 CRITICAL 9.1 Gitea Open Source Git Server — OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes● PoC 2026-08-13 CVE-2026-55984 LOW 2.7 Gitea Open Source Git Server — Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service● PoC 2026-08-13 CVE-2026-55986 MEDIUM 5.4 Gitea Open Source Git Server — Email Management API Bypasses ManageCredentials Feature Restrictions● PoC 2026-08-13 CVE-2026-55987 HIGH 8.1 Gitea Open Source Git Server — OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomp…● PoC 2026-08-13 CVE-2026-56443 CRITICAL 9.6 Gitea Open Source Git Server — Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual aft…● PoC 2026-08-13 CVE-2026-56654 CRITICAL 9.8 Gitea Open Source Git Server — Privilege Escalation via Access Token Scope Escalation in API● PoC 2026-08-13 CVE-2026-56657 MEDIUM 6.2 Gitea Open Source Git Server — Gitea SSH Key Parser Denial of Service 2026-08-13 CVE-2026-56750 CRITICAL 9.1 Gitea Open Source Git Server — Gitea Remember-Me Token Theft Not Invalidating Attacker Session 2026-08-13 CVE-2026-56755 MEDIUM 6.2 Gitea Open Source Git Server — Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload 2026-08-13 CVE-2026-57886 MEDIUM 5.9 Gitea Open Source Git Server — Cross-repository issue/comment attachment re-linking can expose private attachment content 2026-08-13 CVE-2026-57894 HIGH 8.5 Gitea Open Source Git Server — Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Reposi…● PoC 2026-08-13 CVE-2026-57897 MEDIUM 6.5 Gitea Open Source Git Server — Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs 2026-08-13 CVE-2026-58314 HIGH 7.7 Gitea Open Source Git Server — Two SSRF findings in Gitea 1.26.2● PoC 2026-08-13 CVE-2026-58416 HIGH 7.1 Gitea Open Source Git Server — Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR g… 2026-08-13 CVE-2026-58417 HIGH 7.5 Gitea Open Source Git Server — REST API exposes organization membership of private organizations to public● PoC 2026-08-13 CVE-2026-58420 MEDIUM 4.4 Gitea Open Source Git Server — Local File Inclusion via file:// URI in Migration Restore● PoC 2026-08-13 CVE-2026-58425 MEDIUM 4.3 Gitea Open Source Git Server — OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)● PoC 2026-08-13 CVE-2026-58427 HIGH 7.5 Gitea Open Source Git Server — Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 2026-08-13 CVE-2026-58428 MEDIUM 6.5 Gitea Open Source Git Server — Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)● PoC 2026-08-13 CVE-2026-58429 MEDIUM 4.9 Gitea Open Source Git Server — Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints● PoC 2026-08-13 CVE-2026-58431 MEDIUM 4.3 Gitea Open Source Git Server — Public-only API token restriction is not enforced on team API routes● PoC 2026-08-13 CVE-2026-58432 MEDIUM 5.9 Gitea Open Source Git Server — Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment…● PoC 2026-08-13 CVE-2026-58433 CRITICAL 9.1 Gitea Open Source Git Server — Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting● PoC 2026-08-13 CVE-2026-58434 HIGH 7.5 Gitea Open Source Git Server — Private Repository Metadata Remains Accessible After Access Revocation● PoC 2026-08-13 CVE-2026-58435 MEDIUM 5.4 Gitea Open Source Git Server — Gitea LFS Deploy-Key Privilege Escalation● PoC 2026-08-13 CVE-2026-58436 HIGH 7.5 Gitea Open Source Git Server — ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests● PoC 2026-08-13 CVE-2026-58437 HIGH 7.1 Gitea Open Source Git Server — Repository Visibility Manipulation via Git Push Options● PoC 2026-08-13 CVE-2026-58438 HIGH 7.5 Gitea Open Source Git Server — Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos th…● PoC 2026-08-13 CVE-2026-58439 HIGH 8.1 Gitea Open Source Git Server — Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag● PoC 2026-08-13 CVE-2026-58440 MEDIUM 6.8 Gitea Open Source Git Server — Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltra…● PoC 2026-08-13 CVE-2026-58441 MEDIUM 6.3 Gitea Open Source Git Server — SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL● PoC 2026-08-13 CVE-2026-58442 MEDIUM 6.5 Gitea Open Source Git Server — Repository migration SSRF via multi-answer DNS allow-list bypass● PoC 2026-08-13 CVE-2026-58443 CRITICAL 9.1 Gitea Open Source Git Server — Public-only repository tokens can update private PR head branches● PoC 2026-08-13 CVE-2026-58444 MEDIUM 4.3 Gitea Open Source Git Server — Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses p…● PoC 2026-08-13 CVE-2026-58445 LOW 2.7 Gitea Open Source Git Server — Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API● PoC 2026-08-13 CVE-2026-58507 MEDIUM 5.3 Gitea Open Source Git Server — Private Repository Existence Disclosure via go-get Meta Endpoint● PoC 2026-08-13 CVE-2026-58508 CRITICAL 9.1 Gitea Open Source Git Server — Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) 2026-08-13 CVE-2026-58510 MEDIUM 4.3 Gitea Open Source Git Server — GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale wat… 2026-08-13 CVE-2026-58511 LOW 2.7 Gitea Open Source Git Server — Webhook Authorization Header Returned in Plaintext via API● PoC 2026-08-13 CVE-2026-59763 MEDIUM 4.3 Gitea Open Source Git Server — Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads● PoC 2026-08-13 CVE-2026-59765 HIGH 7.5 Gitea Open Source Git Server — SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata● PoC 2026-08-13 CVE-2026-34966 HIGH 8.3 Gitea — Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers…● PoC 2026-08-05