Skip to content
Fencer Intel

All · go

Newest first, late arrivals on top. Also a feed.

  1. 4.4
    CVE-2026-58420 Local File Inclusion via file:// URI in Migration Restore
    go
  2. 2.7
    CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
    go
  3. 9.1
    CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
    go
  4. 7.5
    CVE-2026-58434 Private Repository Metadata Remains Accessible After Access Revocation
    go
  5. 7.5
    CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)
    go
  6. 7.5
    CVE-2026-58417 REST API exposes organization membership of private organizations to public
    go
  7. 4.3
    CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
    go
  8. 7.1
    CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
    go
  9. 6.5
    CVE-2026-42931 Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
    go
  10. 2.7
    CVE-2026-58445 Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
    go
  11. 4.3
    CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents
    go
  12. 9.1
    CVE-2026-58443 Public-only repository tokens can update private PR head branches
    go
  13. 6.5
    CVE-2026-58442 Repository migration SSRF via multi-answer DNS allow-list bypass
    go
  14. 6.3
    CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
    go
  15. 7.5
    CVE-2026-58438 Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
    go
  16. —
    GHSA-rjvx-x5h2-6px5 Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions
    go
  17. 9.8
    CVE-2026-56654 Privilege Escalation via Access Token Scope Escalation in API
    go
  18. 6.2
    CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
    go
  19. 5.3
    CVE-2026-58507 Private Repository Existence Disclosure via go-get Meta Endpoint
    go
  20. 5.9
    CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
    go
  21. 3.1
    CVE-2026-23603 Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
    go
  22. 4.3
    CVE-2026-58425 OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
    go
  23. 4.3
    CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
    go
  24. 9.1
    CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
    go
  25. 5.9
    CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
    go
  26. 6.5
    CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
    go
  27. 9.6
    CVE-2026-56443 Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
    go
  28. 8.1
    CVE-2026-58439 Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag
    go
  29. 4.3
    CVE-2026-59766 Gitea private repository metadata disclosure after access revocation
    go
  30. 6.8
    CVE-2026-58440 Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
    go