2026

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an

Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registra

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSoc

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticat

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allow

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitra

The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TR

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenti

The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows r

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attack

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exp

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic in

Webhook Authorization Header Returned in Plaintext via API

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on pu

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Private Repository Existence Disclosure via go-get Meta Endpoint

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep

Public-only repository tokens can update private PR head branches

Repository migration SSRF via multi-answer DNS allow-list bypass

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of pr

Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot

Repository Visibility Manipulation via Git Push Options

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea LFS Deploy-Key Privilege Escalation

Private Repository Metadata Remains Accessible After Access Revocation

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Criti

Public-only API token restriction is not enforced on team API routes

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Local File Inclusion via file:// URI in Migration Restore

REST API exposes organization membership of private organizations to public

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Two SSRF findings in Gitea 1.26.2

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil

Cross-repository issue/comment attachment re-linking can expose private attachment content

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea SSH Key Parser Denial of Service

Privilege Escalation via Access Token Scope Escalation in API