51 matches found
CVE-2026-60004
CVE-2026-60004 More: https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Dock...
CVE-2026-58436
creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:50+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3...
CVE-2026-58439
creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:45+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-w5pg-649r-p6gg...
CVE-2026-58425
creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:34+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-vxv2-8j6r-pcpg...
Exposure of Private Personal Information to an Unauthorized Actor
Overview Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor in the updateRepository function when a repository is transitioned from public to private via the API. An attacker can access sensitive repository metadata, such as...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the repo.Home handler when a personal access token or OAuth2 token lacking the required scope is used. An attacker can access private repository content, including the README, root file and directory...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to the default configuration of REVERSEPROXYTRUSTEDPROXIES allowing all sources. An attacker can gain unauthorized access by sending spoofed reverse-proxy authentication headers such as X-WEBAUTH-USER...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via insufficient validation of repository creation fields, including length-limited template fields and trust model or object format values. An attacker can submit malformed or unexpected data by providing...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the process handling Composer package source links. An attacker can gain unauthorized access to private or internal package source information by directly accessing these links...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to insufficient permission checks in the draft release process. An attacker can access sensitive draft release data or attachments by bypassing required write permissions. Remediation Upgrade...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the pre-receive process. An attacker can gain unauthorized write access to the entire repository by exploiting cached branch-specific write-permission results across multiple refs within a single session...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper error handling in the pre-receive process when processing input with bufio.Scanner. An attacker can bypass branch-protection checks by submitting oversized input that triggers scanner errors...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...
EUVD-2023-2029
Malicious code in bioql PyPI...
CVE-2023-3515
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4...
CVE-2022-1928
Cross-site Scripting XSS - Stored in GitHub repository go-gitea/gitea prior to 1.16.9...
