CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-77152

    🚨 CVE-2026-77152 Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections"...

  • CVE-2026-110176

    🚨 CVE-2026-110176 The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL...

  • CVE-2026-112887

    🚨 CVE-2026-112887 Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository...

  • CVE-2026-113429

    🚨 CVE-2026-113429 Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served...

  • CVE-2026-114199

    🚨 CVE-2026-114199 `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and...

  • CVE-2026-116289

    🚨 CVE-2026-116289 Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner...

  • CVE-2026-116296

    🚨 CVE-2026-116296 The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A...

  • CVE-2026-116474

    🚨 CVE-2026-116474 The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG...

  • CVE-2026-117635

    🚨 CVE-2026-117635 The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token...

  • CVE-2026-117646

    🚨 CVE-2026-117646 The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private...

  • CVE-2026-117649

    🚨 CVE-2026-117649 The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not...

  • CVE-2026-117677

    🚨 CVE-2026-117677 When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml`...

  • CVE-2026-117685

    🚨 CVE-2026-117685 The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but...

  • CVE-2026-118386

    🚨 CVE-2026-118386 Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork...

  • CVE-2026-118395

    🚨 CVE-2026-118395 Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through...

  • CVE-2026-118504

    🚨 CVE-2026-118504 The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did...

  • CVE-2026-119441

    🚨 CVE-2026-119441 `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only...

  • CVE-2026-119533

    🚨 CVE-2026-119533 Repository and organization project boards listed the pull requests that reference each issue on the board without checking...

Статистика статей

Статьи
53,084
Просмотры
237,111
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.
Назад
Сверху