2970 matches found
Exploit for CVE-2026-60004
CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook In...
Exploit for CVE-2026-60004
CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9...
ROS-20260803-73-0007
The vulnerability of the act Runner component in the Git repository management system Gitea is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
Exploit for CVE-2026-58424
CVE-2026-58424 - Gitea Fork PR Workflow Approval Gate Bypass...
Exploit for CVE-2025-68937
CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated...
The vulnerability of the mechanism for checking OAuth2 scopes in the Gitea repository management system allows a hacker to increase their privileges.
The vulnerability of the mechanism for checking the scopes of OAuth2 tokens in the Gitea Git repository management system is related to access control errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...
The vulnerability of the Git repository management system Gitea lies in the lack of protective measures for website structures, allowing attackers to perform cross-site scripting attacks.
The vulnerability of the Gitea repository management system is related to the lack of measures taken to protect the website structure when processing the extensionsRequired parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks through specially...
Exploit for CVE-2026-60004
🚨 CVE-2026-60004 - RCE Critical Remote Code Execution...
SUSE CVE-2026-20706
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint...
SUSE CVE-2026-20779
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path...
SUSE CVE-2026-20896
Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...
SUSE CVE-2026-22555
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...
SUSE CVE-2026-22874
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering...
SUSE CVE-2026-25714
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941...
SUSE CVE-2026-25779
Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirectto values...
SUSE CVE-2026-26231
Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write...
SUSE CVE-2026-27761
Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope...
SUSE CVE-2026-27771
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...
SUSE CVE-2026-27775
Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access...