PT-2026-48628

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea fails to enforce OAuth2 access token scopes when a token is submitted via HTTP Basic authentication instead of a Bearer token. This occurs because the authentication process in...

CVE-2026-27783

creationtimestamp| type| source ---|---|--- 2026-06-05 22:23:59+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-3fwp-p5rj-2pxf...

CVE-2026-26231

creationtimestamp| type| source ---|---|--- 2026-06-05 22:22:34+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-mm7c-rhg6-qr4r 2026-07-05 20:00:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpweisht6r2g...

CVE-2026-28699

creationtimestamp| type| source ---|---|--- 2026-06-05 22:22:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc 2026-06-11 09:00:04+00:00| published-proof-of-concept| Telegram/X3d0ovB01fXeFh1HIc4iOWU-yKPAhiRlXClKZPas190B7A 2026-06-11...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-azure-storage, opentelemetry-collector, istio, step-issuer, mattermost, hydra, fq, snyk-cli, grafana-pyroscope, flux, cilium, terraform-provider-acme, traefik, hubble, kots, caddy, k3s, vale, karpenter, prometheus, kine, kyverno,...

ROS-20260529-73-0003

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the access control model for the container registry in the Git repository management system Gitea allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the access control model for the container registry in the Git repository management system Gitea is related to the lack of authentication for the critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Exploit for CVE-2026-27771

CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS:...

Gitea Vulnerability Exposes Private Container Images without Authentication

Cybersecurity researchers have disclosed a security flaw in Gitea, an open-source, self-hosted platform for version control, that allows unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. The...

CVE-2026-27771

creationtimestamp| type| source ---|---|--- 2026-05-27 08:06:32+00:00| seen| https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html 2026-05-27 10:09:05+00:00| seen| https://t.me/thehackernews/9089 2026-05-27 12:02:14+00:00| seen|...

CVE-2026-28744

creationtimestamp| type| source ---|---|--- 2026-05-25 19:19:11+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65 2026-07-05 17:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpw2h4rxvw27...