BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Gitea

CVE-2026-114199: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction o

CVE-2026-114199 Nov 1, 2026 Source: Vendor

`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-114199
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
No lines match. , clear filters
Nothing here matches those filters. Clear them to see all 1 lines.