CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-114199

    🚨 CVE-2026-114199 `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and...

  • CVE-2026-116289

    🚨 CVE-2026-116289 Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner...

  • CVE-2026-116296

    🚨 CVE-2026-116296 The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A...

  • CVE-2026-116474

    🚨 CVE-2026-116474 The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG...

  • CVE-2026-117635

    🚨 CVE-2026-117635 The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token...

  • CVE-2026-117646

    🚨 CVE-2026-117646 The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private...

  • CVE-2026-117649

    🚨 CVE-2026-117649 The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not...

  • CVE-2026-117677

    🚨 CVE-2026-117677 When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml`...

  • CVE-2026-117685

    🚨 CVE-2026-117685 The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but...

  • CVE-2026-118386

    🚨 CVE-2026-118386 Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork...

  • CVE-2026-118394

    🚨 CVE-2026-118394 The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by...

  • CVE-2026-118395

    🚨 CVE-2026-118395 Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through...

  • CVE-2026-118504

    🚨 CVE-2026-118504 The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did...

  • CVE-2026-119441

    🚨 CVE-2026-119441 `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only...

  • CVE-2026-119533

    🚨 CVE-2026-119533 Repository and organization project boards listed the pull requests that reference each issue on the board without checking...

  • CVE-2026-119625

    🚨 CVE-2026-119625 The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token...

  • CVE-2026-119627

    🚨 CVE-2026-119627 The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a...

  • CVE-2026-120223

    🚨 CVE-2026-120223 A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file...

Статистика статей

Статьи
53,093
Просмотры
284,159
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.
Назад
Сверху