CVE Vulnerability Catalog

ParseAcceptLanguage in the Locale middleware causes a quadratic-time DoS on unauthenticated requests. Sending specially crafted Accept-Language headers can overload the server.

Private repository metadata remains accessible after access revocation. This means that information about the repository (e.g., name, description) may still be visible to users who lost permissions.

The vulnerability leaks the member list of private organizations via the /members API endpoint. This is an incomplete fix for PR #38145.

The vulnerability in the REST API exposes organization membership of private organizations to the public. Unauthorized individuals can obtain information about members of private organizations.

The vulnerability in Fork-PR Actions tasks allows reading a third private repository via the collaborative-owner branch. A missing fork-PR guard enables this.

Two Server-Side Request Forgery (SSRF) findings in Gitea 1.26.2. They allow an attacker to make requests from the server to internal resources.

The vulnerability in repository migration follows Git HTTP redirects after URL allow/block validation, enabling internal Git repository exfiltration.

OAuth2 sign-in can reactivate an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009).

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an 'in the middle' position can send specially crafted data to a server causing a persistent denial of service.

The internal API HTTP client hardcodes InsecureSkipVerify:true with no config override, disabling TLS certificate verification. This violates CWE-295 (improper certificate validation).

Public-only tokens can bypass private-resource restrictions on `/api/v1/user` self routes.

A vulnerability in the Data::MuForm::Localizer module for Perl (up to version 0.05) allows arbitrary code execution via a crafted message catalog header. The load_lexicon function does not validate the language attribute, enabling loading of any readable .po file and executing code from the Plural-Forms header.

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database schema, access system tables such as information_schema, and chain the disclosure with secondary injection points to extract credential data.

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.

The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in SQL injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

OpenList, a file list program that supports multiple storage, prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validates renameObject.NewName with checkRelativePath, but does not validate attacker-controlled renameObject.SrcName, supplied as src_name, before concatenating it with the authorized path and passing the result to fs.Rename. A user with rename permission can use traversal segments in src_name to make path normalization select a file outside the authorized directory and configured base path, resulting in cross-user file integrity loss, limited availability impact, and file-existence disclosure through success or error responses. This issue is fixed in version 4.2.4.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in XmlFrameDecoder.decode() that fails to preserve closing-tag parser state across invocations. An unauthenticated remote attacker can trickle-feed repeated </ sequences, causing repeated rescans of the accumulated buffer and exhausting an EventLoop thread's CPU, leading to denial of service with a maxFrameLength of 1 MB.

Oh My Posh before version 29.35.1 has a vulnerability in the setStyle() function in src/segments/path.go, which passes pt.Path (including raw folder names) to template.Render, whose function map exposes cmd. An attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt renders inside that directory or a descendant.