PT-2026-55592

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description Unauthorized users can access labels associated with private organizations. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-55598

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description LFS push and sync mirror operations do not utilize the migration HTTP transport. This behavior allows LFS requests to bypass the configured migration transport protections. Recommendations Update Gite...

PT-2026-55596

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software does not consistently enforce the expiry and single-use requirement of OAuth2 authorization codes during the token exchange process. OAuth2 is a standard for access delegation, allowing...

PT-2026-55600

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description A flaw allows a user to change the primary email address of another user. Recommendations Update to version 1.25.5 or later...

PT-2026-55605

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.0 Description The software does not fail closed when encountering bufio.Scanner errors during the processing of pre-receive hook input. This behavior allows oversized input to bypass branch-protection checks...

PT-2026-55594

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description Improper path resolution occurs during the generation of template repositories. This allows template processing to read or write data through symlinks or other non-regular paths, potentially leading t...

PT-2026-55597

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to correctly persist the OAuth2 PKCE S256 challenge method during the authorization process. This flaw allows for token exchange without the required verifier check. PKCE Proof Key...

PT-2026-55603

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description The software caches a branch-specific write-permission result across multiple refs during a single pre-receive hook session. This behavior allows a user with a per-branch maintainer-edit grant to reuse that...

Exploit for CVE-2026-20896

Código de la Prueba de Concepto CVE-2026-20896 Este scri...

FreeBSD : gitea -- multiple vulnerabilities (f00e2de8-7d30-48d2-a43d-68206347dea6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f00e2de8-7d30-48d2-a43d-68206347dea6 advisory. The Gitea team reports: Tenable has extracted the preceding description block directly from th...

CVE-2026-58053

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

EUVD-2026-39973

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-58053 Gitea act_runner - Container Hardening Bypass via Workflow Container Options

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-58053

Gitea act_runner (Docker backend) up to act 0.262.0 is vulnerable: the workflow.container.options are merged into the Docker job container HostConfig, and if privileged is set to false, only the Privileged flag is disabled while options such as --pid=host, --cap-add, and --security-opt remain. A ...

CVE-2026-58053

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: gitea-fips, pdfcpu, rclone-fips, mattermost, bento, seaweedfs-fips, kubescape, gitea, seaweedfs-rocksdb, ollama, seaweedfs-operator, mailpit, mattermost-fips, bento-fips, seaweedfs-operator-fips, ollama-fips, gitlab-workhorse-ce, mailpit-fips, kubescape-server-fips,...

GHSA-M43H-MP45-GHQ6 vulnerabilities

Vulnerabilities for packages: gitea-fips, pdfcpu, rclone-fips, mattermost, bento, seaweedfs-fips, kubescape, gitea, seaweedfs-rocksdb, ollama, seaweedfs-operator, mailpit, mattermost-fips, bento-fips, seaweedfs-operator-fips, ollama-fips, gitlab-workhorse-ce, mailpit-fips, kubescape-server-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone-fips, prometheus, fscrypt, external-secrets-operator, calico-fips, gitlab-workhorse-ce-fips, vitess, flux-fips, mattermost-fips, kubevela-fips, commercial-expanso-edge, etcd, k3s, kubescape-server, frankenphp-8.2, elastic-agent-fips, helm, knative-eventing-fips...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: grype-db, trufflehog-fips, longhorn-cli, syft, drone-fips, amazon-ssm-agent, packer, prometheus, fscrypt, external-secrets-operator, calico-fips, rootlesskit, gitlab-workhorse-ce-fips, podman, mapotf, longhorn-manager-fips, vitess, flux-fips, argo-events-fips,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: grype-db, trufflehog-fips, syft, amazon-ssm-agent, packer, prometheus, fscrypt, external-secrets-operator, calico-fips, gitlab-workhorse-ce-fips, podman, mapotf, vitess, flux-fips, argo-events-fips, mattermost-fips, mapotf-fips, consul, apko-fips, kubevela-fips,...