CVE-2026-96594

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-97208

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-86684

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-106508

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-105268

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-104633

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

CVE-2026-101023

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-106508

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher techdocs.publisher.type: 'local', it was possible for the...

CVE-2026-96594

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-105268 Gitea issue attachment API allows changing comment attachments

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-105268

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-104633 Gitea migration memory exhaustion from zero page size

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

CVE-2026-104633

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

CVE-2026-101023

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-97208

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-106550

Mozilla's Node-convict version 6.2.2 and later is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set. An attacker controlling the configuration key can write arbitrary properties to constructor., which walk resolves to the global...