PkgSeer

Vulnerabilities

Last updated 1 hour ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
code.gitea.io/gitea Gitea allows attackers to add attachments with forbidden file extensions High Risk 8.2 10 months ago 19 hours ago
code.gitea.io/gitea Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata High Risk 7.5 3 months ago 21 days ago
code.gitea.io/gitea Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 Medium Risk 4.3 3 months ago 1 month ago
code.gitea.io/gitea Gitea: Two SSRF findings High Risk 7.7 3 months ago 1 month ago
code.gitea.io/gitea Gitea SSH Key Parser Denial of Service Medium Risk 6.2 3 months ago 1 month ago
code.gitea.io/gitea Gitea draft releases and attachments are exposed without write permission High Risk 7.5 4 months ago 1 month ago
code.gitea.io/gitea Gitea forwarded-proto validation allows canonical URL spoofing High Risk 7.5 4 months ago 1 month ago
code.gitea.io/gitea Gitea pre-receive hook scanner errors allow branch-protection bypass Critical 9.8 4 months ago 1 month ago
code.gitea.io/gitea Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea tracked-time deletion is not scoped to the requested issue Medium Risk 5.3 4 months ago 1 month ago
code.gitea.io/gitea Gitea LFS mirror operations bypass migration HTTP transport protections Critical 9.8 4 months ago 1 month ago
code.gitea.io/gitea Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea Unknown 1 month ago 1 month ago
code.gitea.io/gitea Gitea Cross-site Scripting Vulnerability Critical 9.8 2 years ago 1 month ago
code.gitea.io/gitea code.gitea.io/gitea Open Redirect vulnerability Low Risk 3.0 3 years ago 1 month ago
code.gitea.io/gitea Gitea primary email ownership bypass allows cross-user email changes High Risk 7.5 4 months ago 2 months ago
code.gitea.io/gitea Gitea pull request branch permission checks allow unauthorized updates and rebases High Risk 7.5 4 months ago 2 months ago
code.gitea.io/gitea Gitea exposes tracked time entries without repository authorization Medium Risk 5.3 4 months ago 2 months ago
code.gitea.io/gitea Gitea organization permission APIs expose hidden membership and private organization data High Risk 7.5 4 months ago 2 months ago
code.gitea.io/gitea Gitea OAuth2 authorization codes can be reused after expiry Critical 9.1 4 months ago 2 months ago
code.gitea.io/gitea Gitea release asset dumps permit path traversal through crafted names Medium Risk 5.3 4 months ago 2 months ago
code.gitea.io/gitea Gitea repository creation accepts insufficiently validated fields Critical 9.1 4 months ago 2 months ago
code.gitea.io/gitea Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea OAuth2 PKCE S256 verifier bypass Critical 9.1 4 months ago 2 months ago
code.gitea.io/gitea Gitea template repository generation follows unsafe filesystem paths Critical 9.1 4 months ago 2 months ago
code.gitea.io/gitea Gitea git grep searches allow server resource exhaustion High Risk 7.5 4 months ago 2 months ago
code.gitea.io/gitea Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea Unknown 2 months ago 2 months ago
code.gitea.io/gitea Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag High Risk 8.1 3 months ago 3 months ago
code.gitea.io/gitea Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions Medium Risk 6.0 3 months ago 3 months ago
code.gitea.io/gitea Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes Medium Risk 6.0 3 months ago 3 months ago
code.gitea.io/gitea Gitea: Public-only repository tokens can update private PR head branches Critical 9.6 3 months ago 3 months ago
code.gitea.io/gitea Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private High Risk 7.5 3 months ago 3 months ago
code.gitea.io/gitea Gitea: Unauthorized Access to Labels of Private Organizations High Risk 7.5 3 months ago 3 months ago
code.gitea.io/gitea Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Critical 9.6 3 months ago 3 months ago
code.gitea.io/gitea Gitea: SSRF via HTTP Redirect in Repository Migration Medium Risk 6.5 3 months ago 3 months ago
code.gitea.io/gitea Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint Medium Risk 6.5 3 months ago 3 months ago
code.gitea.io/gitea Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim Low Risk 3.1 3 months ago 3 months ago
code.gitea.io/gitea Gitea LFS Deploy-Key Privilege Escalation Medium Risk 5.4 3 months ago 3 months ago
code.gitea.io/gitea Gitea: draft release attachment disclosure via missing web authorization Medium Risk 5.9 3 months ago 3 months ago
Data courtesy of OSV.dev
Page 1