Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 11:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-26307 | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources. | 7.5 | 04.07.2026 |
| CVE-2026-27657 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. | 7.5 | 04.07.2026 |
| CVE-2026-27660 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. | 7.5 | 04.07.2026 |
| CVE-2026-27761 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope. | 4.3 | 04.07.2026 |
| CVE-2026-22555 | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets. | 8.1 | 04.07.2026 |
| CVE-2026-22874 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. | 9.6 | 04.07.2026 |
| CVE-2026-24451 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized. | 7.5 | 04.07.2026 |
| CVE-2026-24690 | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. | 7.5 | 04.07.2026 |
| CVE-2026-25038 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | 7.5 | 04.07.2026 |
| CVE-2026-25712 | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. | 7.5 | 04.07.2026 |
| CVE-2026-25714 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941. | 4.3 | 04.07.2026 |
| CVE-2026-25718 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths. | 9.1 | 04.07.2026 |
| CVE-2026-25779 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. | 6.1 | 04.07.2026 |
| CVE-2026-14610 | A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. This manipulation causes heap-based buffer overfl | 1.9 | 04.07.2026 |
| CVE-2026-14611 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component Per-Project Auto-Memory Handler. Such manipulation of the argument workspacePath lea | 5.3 | 04.07.2026 |
| CVE-2026-20706 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. | 9.1 | 04.07.2026 |
| CVE-2026-20779 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path. | 7.1 | 04.07.2026 |
| CVE-2026-20896 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. | 9.8 | 04.07.2026 |
| CVE-2026-20909 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. | 5.3 | 04.07.2026 |
| CVE-2026-22547 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. | 9.1 | 04.07.2026 |
| CVE-2026-14609 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The manipulation results in session fixiation. The attack can be executed remotely. The attack requires a | 2.9 | 04.07.2026 |
| CVE-2026-12481 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when | 9.8 | 04.07.2026 |
| CVE-2026-14608 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=view_student of the component POST Handler. The manipulation of th | 2.1 | 03.07.2026 |
| CVE-2026-58379 | A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image fi | 7.3 | 03.07.2026 |
| CVE-2026-14604 | A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetLib/Ply/PlyLoader.cpp of the component PLY Model Handler. This manipulation causes double free. The at | 2.1 | 03.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.