今日共收录 1312 条安全情报，包含 424 个 CVE，492 篇安全通告，以及 116 篇研究论文。
← 返回归档列表CVE-2026-58444
Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep
CVE-2026-58442
Repository migration SSRF via multi-answer DNS allow-list bypass
CVE-2026-58441
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of pr
CVE-2026-58439
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
CVE-2026-58438
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options
CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58435
Gitea LFS Deploy-Key Privilege Escalation
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation
CVE-2026-58432
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti
CVE-2026-58431
Public-only API token restriction is not enforced on team API routes
CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
CVE-2026-58427
Private org member list leaked via /members API endpoint — incomplete fix for PR #38145
CVE-2026-58425
OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
CVE-2026-58420
Local File Inclusion via file:// URI in Migration Restore
CVE-2026-58417
REST API exposes organization membership of private organizations to public
CVE-2026-58314
Two SSRF findings in Gitea 1.26.2
CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil