PT-2026-55592

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description Unauthorized users can access labels associated with private organizations. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-55603

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description The software caches a branch-specific write-permission result across multiple refs during a single pre-receive hook session. This behavior allows a user with a per-branch maintainer-edit grant to reuse that...

PT-2026-55597

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to correctly persist the OAuth2 PKCE S256 challenge method during the authorization process. This flaw allows for token exchange without the required verifier check. PKCE Proof Key...

Exploit for CVE-2026-20896

Código de la Prueba de Concepto CVE-2026-20896 Este scri...

FreeBSD : gitea -- multiple vulnerabilities (f00e2de8-7d30-48d2-a43d-68206347dea6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f00e2de8-7d30-48d2-a43d-68206347dea6 advisory. The Gitea team reports: Tenable has extracted the preceding description block directly from th...

CVE-2026-58053

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

EUVD-2026-39973

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-58053 Gitea act_runner - Container Hardening Bypass via Workflow Container Options

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

CVE-2026-58053

Gitea act_runner (Docker backend) up to act 0.262.0 is vulnerable: the workflow.container.options are merged into the Docker job container HostConfig, and if privileged is set to false, only the Privileged flag is disabled while options such as --pid=host, --cap-add, and --security-opt remain. A ...

CVE-2026-58053

Gitea actrunner with the Docker backend through act 0.262.0 passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-op...

GHSA-M43H-MP45-GHQ6 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, mattermost-fips, mailpit-fips, mattermost, seaweedfs-operator-fips, gitea-fips, rclone-fips, pdfcpu, kubescape-server, ollama-fips, bento-fips, kubescape-server-fips, seaweedfs-rocksdb, gitea, seaweedfs-operator, bento, rclone, seaweedfs,...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, mattermost-fips, mailpit-fips, mattermost, seaweedfs-operator-fips, gitea-fips, rclone-fips, pdfcpu, kubescape-server, ollama-fips, bento-fips, kubescape-server-fips, seaweedfs-rocksdb, gitea, seaweedfs-operator, bento, rclone, seaweedfs,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, chisel, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2, kubernetes-fips, gitea-fips, omnictl-multiarch-fips,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, chisel, longhorn-manager-fips, terraform-fips, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, grype-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, terraform-fips, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, grype-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2, witness, kubernetes-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: k9s, nerdctl, chisel, longhorn-manager-fips, terraform-fips, knative-serving-fips, zarf-fips, flux-image-automation-controller-fips, grype-fips, loki, mattermost-fips, minio, kube-arangodb-fips, mattermost, frankenphp-8.3, skaffold, reports-server, frankenphp-8.2,...

GHSA-M43H-MP45-GHQ6 vulnerabilities

Vulnerabilities for packages: rclone, gitea, mailpit, mattermost, bento, ollama, kubescape, seaweedfs, pdfcpu...

CVE-2026-46601 vulnerabilities

Vulnerabilities for packages: rclone, gitea, mailpit, mattermost, bento, ollama, kubescape, seaweedfs, pdfcpu...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: scorecard, zot, flux-notification-controller, falcoctl, nfpm, step, sops, minio, chisel, kyverno, terraform-provider-azurerm, gitea, terragrunt, rancher-machine, nuclei, gatus, osv-scanner, loki, steampipe, trivy, go-discover, ko, helm, neuvector-sigstore-interface,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kots, spire-server, fscrypt, cilium-cli, external-secrets-operator, flux-image-automation-controller, zot, zarf, kubernetes-dashboard, kaf, aactl, flux-source-controller, rancher, prometheus-operator, snyk-cli, k9s, cloud-provider-aws, skaffold, kubescape, chisel,...