1990 matches found
PT-2026-50138
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.1 Description In the Git Smart HTTP path, the system fails to enforce repository-scoped access-token permissions when tokens are provided via Bearer authentication. While the CheckRepoScopedToken function is design...
CVE-2026-41506 vulnerabilities
Vulnerabilities for packages: osv-scanner, skaffold-fips, argo-events-fips, grafana-alloy-fips, crossplane-fips, grype-fips, k9s-fips, argocd-image-updater, nuclei, trivy-operator-fips, cg, k9s, nemo, act, pulumi, syft-fips, kaniko-fips, mapotf-fips, skaffold, argo-cd, upwind-agent, steampipe,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: telegraf, minio, rancher-webhook, nuclei, juicefs, kyverno-notation-aws, rclone, cert-manager-csi-driver, xeol, teleport, gitea, gitlab-runner, zot, grafana, rancher-agent, k6, seaweedfs, spqr, dex, sftpgo-plugin-auth, harbor, cert-manager, frp,...
GHSA-PJCQ-XVWQ-HHPJ vulnerabilities
Vulnerabilities for packages: telegraf, minio, rancher-webhook, nuclei, juicefs, kyverno-notation-aws, rclone, cert-manager-csi-driver, xeol, teleport, gitea, gitlab-runner, zot, grafana, rancher-agent, k6, seaweedfs, spqr, dex, sftpgo-plugin-auth, harbor, cert-manager, frp,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: ratify, cert-manager-csi-driver, cert-manager-google-cas-issuer-fips, syncthing-fips, syncthing, seaweedfs-rocksdb, juicefs, dex, nuclei, zitadel, elastic-agent-fips, seaweedfs-fips, ldap2pg, cert-manager-istio-csr-fips, teleport, gitlab-runner, vault-fips, terraform...
Insecure Default Initialization of Resource
Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insecure default SSH server configuration, which advertises weak or deprecated key exchange, MAC, and host key algorithms. An attacker can compromise the confidentiality and integrity o...
Insecure Default Initialization of Resource
Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insecure default SSH server configuration, which advertises weak or deprecated key exchange, MAC, and host key algorithms. An attacker can compromise the confidentiality and integrity o...
GHSA-3M6Q-H5GJ-7MRW Gitea has insecure default SSH settings
Summary The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box. Details Running ssh-audit against a default...
Gitea has insecure default SSH settings
Summary The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box. Details Running ssh-audit against a default...
PT-2026-36652
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The built-in SSH server uses default configurations that advertise weak or broken key exchange, MAC, and host key algorithms. Specifically, the server supports the ecdh-sha2-nistp256,...
PT-2026-43391
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Forgejo versions prior to 1.26.2 Description An access control flaw exists in the container registry and Composer package handling. The issue allows unauthenticated remote attackers to pull private container imag...
GHSA-3XC5-WRHM-F963 vulnerabilities
Vulnerabilities for packages: osv-scanner, skaffold-fips, argo-events-fips, grafana-alloy-fips, crossplane-fips, grype-fips, k9s-fips, argocd-image-updater, nuclei, trivy-operator-fips, cg, k9s, nemo, act, pulumi, syft-fips, kaniko-fips, mapotf-fips, skaffold, argo-cd, upwind-agent, steampipe,...
CLEANSTART-2026-XO66325 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
Multiple security vulnerabilities affect the gitea-fips package. Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic See references for individual vulnerability details...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: emissary, opencost, etcd, osv-scanner, terraform-provider-tls-fips, rke2-cloud-provider-fips, crossplane-provider-aws-ssm, k9s-fips, dex, prometheus-adapter, gitlab-pages, falco-exporter-fips, nemo, tetragon-fips, grpc-health-probe-fips, coredns, knative-operator,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: etcd, osv-scanner, syncthing-fips, syncthing, k9s-fips, dex, gitlab-pages, nemo, coredns, knative-operator, seaweedfs-fips, consul-fips, mailpit-fips, k8s-device-plugin, cilium-cli, mattermost-fips, cilium-envoy, commercial-chainloop-cli, vault-fips, terraform,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: etcd, osv-scanner, syncthing-fips, syncthing, k9s-fips, dex, gitlab-pages, nemo, coredns, knative-operator, seaweedfs-fips, consul-fips, mailpit-fips, k8s-device-plugin, cilium-cli, mattermost-fips, cilium-envoy, commercial-chainloop-cli, vault-fips, terraform,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: emissary, opencost, etcd, osv-scanner, terraform-provider-tls-fips, syncthing-fips, cluster-proportional-autoscaler, rke2-cloud-provider-fips, syncthing, crossplane-provider-aws-ssm, k9s-fips, amazon-eks-ami, aws-nuke, dex, omnibump, hugo-extended, prometheus-adapter...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: emissary, opencost, etcd, osv-scanner, terraform-provider-tls-fips, syncthing-fips, cluster-proportional-autoscaler, rke2-cloud-provider-fips, syncthing, crossplane-provider-aws-ssm, k9s-fips, amazon-eks-ami, aws-nuke, dex, omnibump, hugo-extended, prometheus-adapter...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: opencost, osv-scanner, cluster-proportional-autoscaler, gops-fips, flannel-cni-plugin-fips, falco-exporter-fips, go-jsonnet, kubernetes-release, nri-mysql, terraform-provider-sendgrid, fq, kubernetes-dashboard-metrics-scraper, prometheus-statsd-exporter-fips,...
GHSA-GJVH-7JH8-7XHM vulnerabilities
Vulnerabilities for packages: emissary, opencost, etcd, osv-scanner, terraform-provider-tls-fips, syncthing-fips, cluster-proportional-autoscaler, rke2-cloud-provider-fips, syncthing, crossplane-provider-aws-ssm, k9s-fips, amazon-eks-ami, aws-nuke, dex, omnibump, hugo-extended, prometheus-adapter...