OSV - Open Source Vulnerabilities

GHSA-hrxh-6v49-42gf

Go/google.golang.org/grpc

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

3 hours ago

Fix available
Severity - 8.8 (High)

GHSA-gx3v-q759-g323

Go/code.gitea.io/gitea

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

3 hours ago

Fix available
Severity - 7.1 (High)

GHSA-fq2p-5p22-8g6j

Go/code.gitea.io/gitea

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

3 hours ago

Fix available
Severity - 4.9 (Medium)

GHSA-2wm4-vwp6-v7xc

Go/code.gitea.io/gitea

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

3 hours ago

Fix available
Severity - 6.9 (Medium)

GHSA-3r5c-2xxx-h872

Go/code.gitea.io/gitea

Gitea: Webhook Authorization Header Returned in Plaintext via API

3 hours ago

Fix available
Severity - 2.7 (Low)

GHSA-frpw-3h2q-4jj6

Go/code.gitea.io/gitea

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

3 hours ago

Fix available
Severity - 6.5 (Medium)

GHSA-q423-49rw-g9mh

Go/code.gitea.io/gitea

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

3 hours ago

Fix available
Severity - 4.3 (Medium)

GHSA-h56g-4qw7-2mxg

Go/gitea.dev

Gitea: Public-only API token restriction is not enforced on team API routes

3 hours ago

Fix available
Severity - 4.3 (Medium)

GHSA-prr9-9mp4-5gp2

Go/gitea.dev

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

3 hours ago

Fix available

GHSA-g9g6-qhrc-p3qc

Go/code.gitea.io/gitea

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

3 hours ago

Fix available
Severity - 7.6 (High)

GHSA-44qc-pgvp-wx7v

Go/code.gitea.io/gitea

Gitea: Notification API leaks private issue metadata after access revocation

3 hours ago

Fix available
Severity - 7.5 (High)

GHSA-v73x-hx65-6pf4

Go/code.gitea.io/gitea

Gitea: Unauthorized Access to Labels of Private Organizations

3 hours ago

Fix available
Severity - 7.5 (High)

GHSA-649p-mmhf-85c7

Go/code.gitea.io/gitea

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

3 hours ago

Fix available
Severity - 8.8 (High)

GHSA-wrf9-r3h7-7x5v

Go/code.gitea.io/gitea

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

3 hours ago

Fix available
Severity - 7.5 (High)

GHSA-2fcr-jfvc-vgg2

Go/code.gitea.io/gitea

Gitea: Two SSRF findings

3 hours ago

Fix available
Severity - 7.7 (High)

GHSA-fw57-jgch-pgf3

Go/code.gitea.io/gitea

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

4 hours ago

Fix available
Severity - 8.7 (High)