CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763

The Git repository management system Gitea is vulnerable to resource amplification during package uploads due to unbounded Arch package file metadata . This issue can lead to service failures (Remote Denial of Service) as reported in related advisories like BDU:2026-15787 and ROS-20260813-73-0011...

EUVD-2026-58125

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-59763 Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

EUVD-2026-58174

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58508

The Git repository management system Gitea contains two Server-Side Request Forgery (SSRF) vulnerabilities within its migration and mirror functions. The root causes are identified as DNS rebinding and a lack of re-validation , which may allow a remote attacker to induce the server to make unauth...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

EUVD-2026-58162

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435

Gitea's LFS server is vulnerable to a privilege escalation flaw due to a trust-boundary confusion in how it handles deploy keys . The system incorrectly sets the UserID in LFS JWT tokens to the repository owner's ID rather than the specific deploy key's identity. Consequently, an attacker possess...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58435 Gitea LFS Deploy-Key Privilege Escalation

Gitea LFS Deploy-Key Privilege Escalation...

CVE-2026-58432

The Gitea application (code.gitea.io/gitea) is vulnerable to Missing Authorization and Authorization Bypass issues. These flaws can be triggered through a user-controlled key or incorrect permission assignments for critical resources, potentially leading to the exposure of sensitive information t...

CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

EUVD-2026-58159

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

CVE-2026-58432 Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...