FreeBSD : Gitea -- multiple vulnerabilities (fac18f5f-afc2-11f1-8266-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fac18f5f-afc2-11f1-8266-3c7c3fba4204 advisory. Gitea reports: This release contains fixes for 26 security issues, hardens issue searching tha...

OPENSUSE-SU-2026:11772-1 gitea-tea-0.16.0-1.1 on GA media

These are all security issues fixed in the gitea-tea-0.16.0-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-6433 vulnerabilities

Vulnerabilities for packages: gitea-fips, gitea...

GO-2026-6347 Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea

Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea...

GO-2026-6346 Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea

Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea...

GO-2026-6345 Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea

Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea...

GO-2026-6343 Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea

Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea...

GO-2026-6433 Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev

Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev...

GO-2026-6344 Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea

Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea...

GHSA-RCR6-4JQH-J84M vulnerabilities

Vulnerabilities for packages: gitea-fips, gitea...

SUSE CVE-2026-20909

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

SUSE CVE-2026-22547

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

SUSE CVE-2026-24690

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...

SUSE CVE-2026-25712

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations...

SUSE CVE-2026-25718

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...

SUSE CVE-2026-26232

Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange...

SUSE CVE-2026-26247

Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...

SUSE CVE-2026-26307

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources...

SUSE CVE-2026-27657

Gitea versions before 1.25.5 allow a user to change another user's primary email address...

SUSE CVE-2026-28705

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths...