CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-22555

    🚨 CVE-2026-22555 Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo...

  • CVE-2026-22874

    🚨 CVE-2026-22874 Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

  • CVE-2026-24451

    🚨 CVE-2026-24451 Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a...

  • CVE-2026-24690

    🚨 CVE-2026-24690 Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

  • CVE-2026-25712

    🚨 CVE-2026-25712 Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private...

  • CVE-2026-25714

    🚨 CVE-2026-25714 Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API...

  • CVE-2026-25718

    🚨 CVE-2026-25718 Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to...

  • CVE-2026-25779

    🚨 CVE-2026-25779 Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.

  • CVE-2026-25782

    🚨 CVE-2026-25782 Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL...

  • CVE-2026-26231

    🚨 CVE-2026-26231 Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to...

  • CVE-2026-26232

    🚨 CVE-2026-26232 Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token...

  • CVE-2026-26247

    🚨 CVE-2026-26247 Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token...

  • CVE-2026-26292

    🚨 CVE-2026-26292 Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the...

  • CVE-2026-26307

    🚨 CVE-2026-26307 Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

  • CVE-2026-27657

    🚨 CVE-2026-27657 Gitea versions before 1.25.5 allow a user to change another user's primary email address.

  • CVE-2026-27660

    🚨 CVE-2026-27660 Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

  • CVE-2026-27761

    🚨 CVE-2026-27761 Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks...

  • CVE-2026-27771

    🚨 CVE-2026-27771 Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose...

Статистика статей

Статьи
53,092
Просмотры
271,555
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.
Назад
Сверху