2043 matches found
CVE-2026-27136 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
GHSA-W9P8-PVXH-RXPJ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
GHSA-WRH2-89VG-4J9G vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
GHSA-5CV4-JP36-H3MW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
CVE-2026-42502 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
GHSA-CG87-VWWH-XVGJ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, vale, kine, karpenter, prometheus, prometheus-operator, step-issuer, kubernetes, fq, hydra, grafana-pyroscope, zot, caddy, cilium, gptscript, istio, ingress-nginx-controller, telegraf, minio, helm, traefik...
The vulnerability of the access control model for the container registry in the Git repository management system Gitea allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the access control model for the container registry in the Git repository management system Gitea is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...
ROS-20260529-73-0003
The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...
Exploit for CVE-2026-27771
CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS:...
Gitea Vulnerability Exposes Private Container Images without Authentication
Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. The...
CVE-2026-27771
creationtimestamp| type| source ---|---|--- 2026-05-27 08:06:32+00:00| seen| https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html 2026-05-27 10:09:05+00:00| seen| https://t.me/thehackernews/9089 2026-05-27 12:02:14+00:00| seen|...
CVE-2026-28744
creationtimestamp| type| source ---|---|--- 2026-05-25 19:19:11+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65 2026-07-05 17:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpw2h4rxvw27...
PT-2026-52217
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.3 Description Incomplete Server-Side Request Forgery SSRF protection exists within the webhook and migration allow-list filtering. SSRF is a flaw that allows an attacker to induce the server-side application to mak...
PT-2026-50138
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.1 Description In the Git Smart HTTP path, the system fails to enforce repository-scoped access-token permissions when tokens are provided via Bearer authentication. While the CheckRepoScopedToken function is design...
CVE-2026-41506 vulnerabilities
Vulnerabilities for packages: argo-cd-fips, bom, crossplane-fips, kubescape, grafana, nemo, snyk-cli, argo-workflows-fips, pulumi-language-dotnet, cloudbeat-fips, xeol-fips, argo-cd, zot, gitlab-rails-ce-fips, kyverno, guac, skaffold, grype, cerbos, chainctl, cloudbeat, apko, goreleaser, kubevela...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: seaweedfs, cert-manager-csi-driver, cert-manager-cmctl, opentofu, harbor, teleport, dex, spqr, nuclei, zot, sftpgo-plugin-auth, percona-server-mongodb-operator, gitlab-runner, telegraf, minio, rancher-webhook, grafana, terraform, cert-manager-istio-csr, rclone,...
GHSA-PJCQ-XVWQ-HHPJ vulnerabilities
Vulnerabilities for packages: seaweedfs, cert-manager-csi-driver, cert-manager-cmctl, opentofu, harbor, teleport, dex, spqr, nuclei, zot, sftpgo-plugin-auth, percona-server-mongodb-operator, gitlab-runner, telegraf, minio, rancher-webhook, grafana, terraform, cert-manager-istio-csr, rclone,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: grafana, external-secrets-fips, k6-fips, versitygw-fips, xeol-fips, cloudbeat-fips, zot, beats-fips, kyverno, frp, spqr, cloudbeat, ratify-fips, percona-server-mongodb-operator-fips, zitadel, sftpgo-plugin-auth, cert-manager-fips, agentbeat-fips, flux-fips, neuvector...
Insecure Default Initialization of Resource
Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insecure default SSH server configuration, which advertises weak or deprecated key exchange, MAC, and host key algorithms. An attacker can compromise the confidentiality and integrity o...
Insecure Default Initialization of Resource
Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insecure default SSH server configuration, which advertises weak or deprecated key exchange, MAC, and host key algorithms. An attacker can compromise the confidentiality and integrity o...