Linux Distros Unpatched Vulnerability : CVE-2022-38183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any...

Linux Distros Unpatched Vulnerability : CVE-2021-45327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remo...

Linux Distros Unpatched Vulnerability : CVE-2019-1010261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component...

Linux Distros Unpatched Vulnerability : CVE-2019-1010314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The...

Linux Distros Unpatched Vulnerability : CVE-2021-45328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs. CVE-2021-45328 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2021-39867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Reque...

CVE-2025-54864

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

PT-2025-32685 · Hydra · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit f7bda02 Description: Hydra is a continuous integration service for Nix based projects. The /api/push-github and /api/push-gitea API endpoints were called by their respective forges without HTTP Basic...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: openbao-k8s, glow, pguser, snyk-cli, jitsucom-bulker, terraform-provider-kubernetes, rabbitmq-messaging-topology-operator, spire-server, hubble, kube-bench, zot, docker-credential-gcr, db-operator, wolfictl, crossplane-provider-azure, kind, logstash-exporter,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: openbao-k8s, glow, pguser, snyk-cli, jitsucom-bulker, terraform-provider-kubernetes, rabbitmq-messaging-topology-operator, spire-server, hubble, kube-bench, zot, docker-credential-gcr, db-operator, wolfictl, crossplane-provider-azure, kind, logstash-exporter,...

CVE-2023-3515

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...

CVE-2022-46685

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log...

CVE-2022-30781

Gitea before 1.16.7 does not escape git fetch remote...

CVE-2022-1928

Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...

CVE-2021-3382

Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service crash via vectors related to a file path...

CVE-2021-45328

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs...

CVE-2021-45327

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code...