共收录 62800 条相关情报。
← 返回所有主题CVE-2026-117677
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.ya
CVE-2026-117649
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access,
CVE-2026-117646
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included p
CVE-2026-117635
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only t
CVE-2026-116474
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email
CVE-2026-116296
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived reposit
CVE-2026-116289
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions r
CVE-2026-114199
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner a
CVE-2026-113429
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that i
CVE-2026-112887
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, org
CVE-2026-120218
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of th
CVE-2026-120217
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file lo
CVE-2026-120198
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the f
CVE-2026-118168
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler render
CVE-2026-113482
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputti
CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a po
CVE-2026-107343
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check
CVE-2026-107342
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check
CVE-2026-120197
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wap
CVE-2026-120196
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/w