48 matches found
CVE-2026-60004-Gitea-Validator
🫖 CVE-2026-60004 Gitea Validator A standalone discovery, assessment, and contract-correlated validation tool for the Gitea diffpatch Git-hook remote code execution vulnerability. scanner.py gives penetration testers, defenders, and security researchers one dependency-free tool for: 🔎 Passive Gite...
Exploit for Code Injection in Gitea
🫖 CVE-2026-60004 — Gitea RCE PoC A direct, single-target va...
Exploit for Code Injection in Gitea
🫖 CVE-2026-60004 Gitea Validator A standalone discovery, as...
BIT-GITEA-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
CVE-2026-60004 is a critical RCE in Gitea (and Forgejo ) versions 1.17–1.27.0 (CVSS 9.8). The flaw is in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, where patches are applied in a bare temporary clone whose root is $GIT_DIR. Submitting the same malicious patch twice triggers an add/...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea. The vulnerability in question is CVE-2026-60004 CVSS score: 9.8, a case of remote code execution that allows an...
CVE-2026-60004: Improper Control of Generation of Code
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
Exploit for CVE-2026-60004
CVE-2026-60004 — Gitea = 1.27.0 Pre-Auth Remote Code Executio...
Gitea Code Injection Vulnerability
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...
VulnCheck KEV: CVE-2026-60004
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...
Gitea 1.27.0 diffpatch Remote Code Execution
Gitea version 1.27.0 and below contains a remote code execution vulnerability in the diffpatch API. An authenticated attacker with repository write access can submit the same specially crafted patch multiple times to trigger Git's three-way merge fallback and cause an executable post-index-change...
FreeBSD : gitea -- Multiple vulnerabilities (f4af92f7-95ae-11f1-a6f7-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4af92f7-95ae-11f1-a6f7-b42e991fc52e advisory. Gitea reports This release addresses the following security vulnerabilities. Please upgrade as...
gitea -- Multiple vulnerabilities
Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...