[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-23603":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":23,"aliases":24,"duplicate_of":9,"upstream":27,"downstream":28,"duplicates":35,"related":36,"reserved_at":9,"published_at":40,"modified_at":41,"state":42,"summary":43,"references_raw":51,"kevs":91,"epss":92,"epss_history":95,"metrics":206,"affected":216},"CVE-2026-23603","Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-918","Server-Side Request Forgery (SSRF)","The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.","weakness","Incomplete","Base",[19],{"id":20,"name":21,"techniques":22},"CAPEC-664","Server Side Request Forgery",[],[],[25,26],"GHSA-x77v-q46j-393g","GO-2026-6083",[],[29,31,33],{"_key":30},"OPENSUSE-SU-2026:21551-1",{"_key":32},"SUSE-SU-2026:23216-1",{"_key":34},"SUSE-SU-2026:23227-1",[],[37,38,39],{"_key":30},{"_key":32},{"_key":34},"2026-08-13T16:44:38.451Z","2026-08-14T17:45:37.628Z","Deferred",{"cisa_kev":44,"cisa_ransomware":44,"cisa_vendor":9,"epss_severity":45,"epss_score":46,"severity":45,"severity_score":47,"severity_version":48,"severity_source":49,"severity_vector":50,"severity_status":42},false,"low",0.00248,3.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",[52,61,65,69,73,77,82,87],{"url":53,"sources":54,"tags":57},"https://github.com/go-gitea/gitea/security/advisories/GHSA-x77v-q46j-393g",[55,49,56],"osv_go","nvd",[58,59,60],"WEB","Advisory","Vendor Advisory",{"url":62,"sources":63,"tags":64},"https://github.com/go-gitea/gitea/pull/38406",[55],[58],{"url":66,"sources":67,"tags":68},"https://github.com/go-gitea/gitea/pull/38426",[55],[58],{"url":70,"sources":71,"tags":72},"https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31",[55],[58],{"url":74,"sources":75,"tags":76},"https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf",[55],[58],{"url":78,"sources":79,"tags":80},"https://github.com/go-gitea/gitea",[55],[81],"PACKAGE",{"url":83,"sources":84,"tags":85},"https://github.com/go-gitea/gitea/releases/tag/v1.27.0",[55,49,56],[58,86],"Release Notes",{"url":88,"sources":89,"tags":90},"https://blog.gitea.com/gitea-1.27.0-is-released/",[49,56],[86],[],{"date":93,"score":46,"percentile":94},"2026-09-19",0.16404,[96,100,104,107,110,113,116,119,122,124,127,130,133,136,139,142,145,148,151,154,157,160,163,166,169,172,175,178,181,184,187,190,193,196,199,202,205],{"date":97,"score":98,"percentile":99},"2026-08-14",0.00158,0.05443,{"date":101,"score":102,"percentile":103},"2026-08-15",0.00229,0.1396,{"date":105,"score":102,"percentile":106},"2026-08-16",0.13984,{"date":108,"score":102,"percentile":109},"2026-08-17",0.13909,{"date":111,"score":102,"percentile":112},"2026-08-18",0.13915,{"date":114,"score":102,"percentile":115},"2026-08-19",0.13957,{"date":117,"score":102,"percentile":118},"2026-08-20",0.13969,{"date":120,"score":102,"percentile":121},"2026-08-21",0.1397,{"date":123,"score":102,"percentile":118},"2026-08-22",{"date":125,"score":102,"percentile":126},"2026-08-23",0.13976,{"date":128,"score":46,"percentile":129},"2026-08-24",0.15805,{"date":131,"score":46,"percentile":132},"2026-08-25",0.15817,{"date":134,"score":46,"percentile":135},"2026-08-26",0.15869,{"date":137,"score":46,"percentile":138},"2026-08-27",0.15867,{"date":140,"score":46,"percentile":141},"2026-08-28",0.15881,{"date":143,"score":46,"percentile":144},"2026-08-29",0.15888,{"date":146,"score":46,"percentile":147},"2026-08-30",0.15909,{"date":149,"score":46,"percentile":150},"2026-08-31",0.15905,{"date":152,"score":46,"percentile":153},"2026-09-01",0.15923,{"date":155,"score":46,"percentile":156},"2026-09-02",0.15933,{"date":158,"score":46,"percentile":159},"2026-09-03",0.15935,{"date":161,"score":46,"percentile":162},"2026-09-04",0.15957,{"date":164,"score":46,"percentile":165},"2026-09-05",0.15971,{"date":167,"score":46,"percentile":168},"2026-09-06",0.15993,{"date":170,"score":46,"percentile":171},"2026-09-07",0.1598,{"date":173,"score":46,"percentile":174},"2026-09-08",0.15991,{"date":176,"score":46,"percentile":177},"2026-09-09",0.16063,{"date":179,"score":46,"percentile":180},"2026-09-10",0.16051,{"date":182,"score":46,"percentile":183},"2026-09-11",0.16055,{"date":185,"score":46,"percentile":186},"2026-09-12",0.16162,{"date":188,"score":46,"percentile":189},"2026-09-13",0.16112,{"date":191,"score":46,"percentile":192},"2026-09-14",0.1613,{"date":194,"score":46,"percentile":195},"2026-09-15",0.16189,{"date":197,"score":46,"percentile":198},"2026-09-16",0.16246,{"date":200,"score":46,"percentile":201},"2026-09-17",0.16291,{"date":203,"score":46,"percentile":204},"2026-09-18",0.16427,{"date":93,"score":46,"percentile":94},[207,211,214],{"source":55,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":208,"cvss_v4_0":9},{"baseScore":47,"baseSeverity":9,"vectorString":50,"impactScore":209,"exploitabilityScore":210},2.3,4.1,{"source":49,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":212,"cvss_v4_0":9},{"baseScore":47,"baseSeverity":213,"vectorString":50,"impactScore":209,"exploitabilityScore":210},"LOW",{"source":56,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":215,"cvss_v4_0":9},{"baseScore":47,"baseSeverity":213,"vectorString":50,"impactScore":209,"exploitabilityScore":210},[217,228,239],{"ecosystem":9,"name":218,"vendor":219,"product":220,"cpe_part":221,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":222},"Gitea Open Source Git Server","gitea","gitea open source git server","a",[223],{"version":224,"is_range":225,"range_type":49,"version_start":9,"version_start_type":9,"version_end":226,"version_end_type":227,"fixed_in":9},"\u003C= 1.26.4",true,"1.26.4","including",{"ecosystem":229,"name":230,"vendor":231,"product":219,"cpe_part":9,"purl_type":232,"purl_namespace":231,"purl_name":219,"source":9,"versions":233},"Go","code.gitea.io/gitea","code.gitea.io","golang",[234],{"version":235,"is_range":225,"range_type":236,"version_start":9,"version_start_type":9,"version_end":237,"version_end_type":238,"fixed_in":9},"lt1_27_0","semver","1.27.0","excluding",{"ecosystem":229,"name":240,"vendor":229,"product":240,"cpe_part":9,"purl_type":232,"purl_namespace":9,"purl_name":240,"source":9,"versions":241},"gitea.dev",[242],{"version":235,"is_range":225,"range_type":236,"version_start":9,"version_start_type":9,"version_end":237,"version_end_type":238,"fixed_in":9}]