CVE-2026-57897

MediumCVSS 6.5/10Last modified Aug 26, 2026

Description

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-863

Affected software

VendorProductVersions
GiteaGitea Open Source Git Server<= 1.26.4

References

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-578989.0In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to CVE-2026-57905.1Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and CVE-2026-579078.5A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection CVE-2026-579099.4A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary codCVE-2026-57916.5Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery. TCVE-2026-579109.3Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitraCVE-2026-579127.5Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about studentCVE-2026-579137.5Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.CVE-2026-579146.5By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can CVE-2026-579157.3It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported typeCVE-2026-579164.6proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate CVE-2026-579174.8proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading
CVE-2026-57897: Medium severity, CVSS 6.5 | Vulnix