2028 matches found
Gitea-Git-Hooks-RCE-CVE-2020-14144-
Gitea Git Hooks RCE CVE-2020-14144 OffsecProvingGrounds अभ्यास — Roquefort मशीन राइटअप और POC अवलोकन...
Exploit for CVE-2026-20896
CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC...
reposaur
Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...
openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2026:21603-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21603-1 advisory. Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913:...
CVE-2026-54481
A flaw was found in Gitea. The internal API HTTP client is configured to skip Transport Layer Security TLS certificate verification, which is an insecure practice. A remote attacker on the same network segment could exploit this vulnerability to perform man-in-the-middle MITM attacks. This allows...
CVE-2026-58439
A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...
CVE-2026-58437
A flaw was found in Gitea. This vulnerability allows an attacker to manipulate repository visibility settings by leveraging specific Git push options. This could lead to unauthorized disclosure of repository information or unintended access control changes. Mitigation Mitigation for this issue is...
CVE-2026-58436
A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumptio...
CVE-2026-56750
A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability ca...
CVE-2026-56654
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...
Security update for gitea-tea (important)
openSUSE security update: security update for gitea-tea ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21603-1 Rating: important References: bsc1234598 bsc1235367 bsc1239493 bsc1241819 bsc1251471 bsc1251663 bsc1253576 Cross-References: CVE-2024-453...
CVE-2026-58438
A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference IDOR, exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private...
CVE-2026-58440
A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. Mitigation To mitigate this...
CVE-2026-55987
A flaw was found in Gitea. An attacker can reactivate an administrator-deactivated account by signing in via OAuth2, specifically when using authentication sources that do not utilize refresh tokens. This bypasses intended security controls, allowing unauthorized access to previously deactivated...
CVE-2026-55984
A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...
OPENSUSE-SU-2026:21603-1 Security update for gitea-tea
This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing...
CVE-2026-58417
A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: kitty, kubescape, ollama-fips, bento-fips, rclone-fips, rclone, ollama, seaweedfs-operator, kubescape-server-fips, mattermost, seaweedfs-rocksdb-fips, kubescape-server, pdfcpu, bento, seaweedfs-operator-fips, mailpit-fips, seaweedfs, fortio-fips, gitea-fips, fortio,...
