CVE-2025-59937 vulnerabilities

Vulnerabilities for packages: gitea-fips, sftpgo, gitea...

GHSA-WPWJ-69CM-Q9C5 vulnerabilities

Vulnerabilities for packages: gitea-fips, sftpgo, gitea...

Linux Distros Unpatched Vulnerability : CVE-2018-18926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the...

Linux Distros Unpatched Vulnerability : CVE-2021-45329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting XSS vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field. CVE-2021-45329...

Linux Distros Unpatched Vulnerability : CVE-2021-45325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server Side Request Forgery SSRF vulneraility exists in Gitea before 1.7.0 using the OpenID URL. CVE-2021-45325 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2019-11576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the A...

Linux Distros Unpatched Vulnerability : CVE-2021-45326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests...

Linux Distros Unpatched Vulnerability : CVE-2022-38183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any...

Linux Distros Unpatched Vulnerability : CVE-2019-1010261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component...

Linux Distros Unpatched Vulnerability : CVE-2021-45327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remo...

Linux Distros Unpatched Vulnerability : CVE-2019-1010314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting XSS. The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The...

Linux Distros Unpatched Vulnerability : CVE-2021-45328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs. CVE-2021-45328 Note that Nessus relies on the presence of...

Linux Distros Unpatched Vulnerability : CVE-2021-39867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Reque...

CVE-2025-54864

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

PT-2025-32685 · Hydra · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to commit f7bda02 Description: Hydra is a continuous integration service for Nix based projects. The /api/push-github and /api/push-gitea API endpoints were called by their respective forges without HTTP Basic...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: portieris, newrelic-nri-kube-events, podman, cri-tools, prometheus-operator, dask-gateway, azure-workload-identity-webhook, newrelic-infra-operator, glow, kubernetes-csi-driver-hostpath, hydra, k6, hubble, cluster-api-azure-controller, seaweedfs, dive,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: portieris, newrelic-nri-kube-events, podman, cri-tools, prometheus-operator, dask-gateway, azure-workload-identity-webhook, newrelic-infra-operator, glow, kubernetes-csi-driver-hostpath, hydra, k6, hubble, cluster-api-azure-controller, seaweedfs, dive,...