共收录 2098 条相关情报。
← 返回所有主题CVE-2026-106471
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Veri
CVE-2026-97626
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: app
CVE-2026-97208
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether
CVE-2026-89182
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still app
CVE-2026-86684
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file syste
CVE-2026-106498
Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backs
CVE-2026-106497
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend pac
CVE-2026-106496
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend pac
CVE-2026-105268
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also a
CVE-2026-105267
The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit,
CVE-2026-106492
Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaul
CVE-2026-106463
Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-mod
CVE-2026-106462
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may no
CVE-2026-106461
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend
CVE-2026-106458
Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-ba
CVE-2026-106456
Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-back
CVE-2026-96589
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access a
CVE-2026-94205
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather t
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks
CVE-2026-103007
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi