2026

REST API exposes organization membership of private organizations to public

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Two SSRF findings in Gitea 1.26.2

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil

Cross-repository issue/comment attachment re-linking can expose private attachment content

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea SSH Key Parser Denial of Service

Privilege Escalation via Access Token Scope Escalation in API

Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-202

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix o

Email Management API Bypasses ManageCredentials Feature Restrictions

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with a

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creat

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch an

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitra

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion beca

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in clas

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators t

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice i

In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange W

In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Clie

In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document edi

In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Cla

An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions Complet

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served t

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure

The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write v

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 1

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute a

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unkn

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x *

vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex paramet

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename hand

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.