The vulnerability of the EditReleasePost() function in the routers/web/repo/release.go file and the UpdateRelease() function in the services/release/release.go file of the Git repository management system Gitea allows a attacker to compromise the integrity of the protected information.

The vulnerability of the EditReleasePost function in the routers/web/repo/release.go file and the UpdateRelease function in the services/release/release.go file of the Git repository management system Gitea is related to the use of names with incorrect links. Exploiting this vulnerability could...

Vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/{username}/orgs/{org}/permissions of the Git repository management system Gitea, allowing attackers to disclose sensitive information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

The vulnerability of RSS and Atom feed handlers in the Git repository management system Gitea allows a hacker to disclose protected information.

The vulnerability of RSS and Atom feed handlers in the Git repository management system Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

CLEANSTART-2025-OQ04236 Cross Site Scripting (XSS) vulnerability exists in Gitea before 1

Security vulnerability affects the gitea package. Cross Site Scripting XSS vulnerability exists in Gitea before 1...

CLEANSTART-2025-HO72707 Authentication Bypass vulnerability exists in Gitea before 1

Security vulnerability affects the gitea package. An Authentication Bypass vulnerability exists in Gitea before 1...

CLEANSTART-2025-GJ07641 Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1

Security vulnerability affects the gitea package. Cross Site Request Forgery CSRF vulnerability exists in Gitea before 1...

CLEANSTART-2025-DO86030 Gitea before 1

Security vulnerability affects the gitea package. Gitea before 1...

CLEANSTART-2025-DZ77580 Stack buffer overflow vulnerability in gitea 1

Security vulnerability affects the gitea package. Stack buffer overflow vulnerability in gitea 1...

CLEANSTART-2025-BP00020 Gitea 1

Security vulnerability affects the gitea package. Gitea 1...

CLEANSTART-2025-LJ89102 avatar middleware in Gitea before 1

Security vulnerability affects the gitea package. The avatar middleware in Gitea before 1...

CLEANSTART-2025-ZP95072 bluemonday before 1

Security vulnerability affects the gitea package. bluemonday before 1...

CLEANSTART-2025-CI95096 jwt-go before 4

Security vulnerability affects the gitea package. jwt-go before 4...

CLEANSTART-2025-IL34570 arbitrary file deletion vulnerability in Gitea v1

Security vulnerability affects the gitea package. An arbitrary file deletion vulnerability in Gitea v1...

CLEANSTART-2025-TF34768 Gitea before 1

Security vulnerability affects the gitea package. Gitea before 1...

CLEANSTART-2025-JO83815 Gitea before 1

Security vulnerability affects the gitea package. Gitea before 1...

Exploit for CVE-2026-600004

CVE-2026-60004 - Functional script — Gitea RCE via diffpatch G...

The vulnerability of the Git repository management system Gitea, related to deficiencies in the authentication process, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Git repository management system Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20260923-73-0001

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information...

SUSE CVE-2026-25782

Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue...

SUSE CVE-2026-26292

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests...