CVE-2026-28699 Gitea Basic Auth bypasses OAuth2 access token scopes

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication...

CVE-2026-27660 Gitea draft releases use insufficient permission checks

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission...

CVE-2026-27657

CVE-2026-27657 affects Gitea prior to 1.25.5. The issue arises in the email settings workflow where a user can alter another user’s primary email address, described as an Authorization Bypass Through User-Controlled Key. Affected evidence in connected sources indicates the root cause is insuffici...

CVE-2026-27657 Gitea email settings allow changing another user's primary email address

Gitea versions before 1.25.5 allow a user to change another user's primary email address...

EUVD-2026-41624

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...

CVE-2026-24451

Gitea 1.26.2 has an information exposure vulnerability where fork synchronization continues after the parent repo switches from public to private, allowing a fork to access data it should not be authorized to see. Connected sources identify this as affecting Gitea components through the fork sync...

CVE-2026-24690 Gitea pull-request branch updates use insufficient permission checks

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches...

CVE-2026-14612

creationtimestamp| type| source ---|---|--- 2026-07-03 18:15:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpr5p36m2x2g 2026-07-03 18:38:09+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpr6wxqjhl25...

CVE-2026-52188

creationtimestamp| type| source ---|---|--- 2026-07-03 17:22:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr2oxwnpc2f...

CVE-2026-38970

creationtimestamp| type| source ---|---|--- 2026-07-03 17:20:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpr2mjar6a2w...

CVE-2026-14613

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

CVE-2026-53224

creationtimestamp| type| source ---|---|--- 2026-07-03 15:55:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqvumyd6w2m 2026-09-01 04:46:02+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260901...

CVE-2026-53222

creationtimestamp| type| source ---|---|--- 2026-07-03 15:55:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqvtroutk2c...

CVE-2026-14613

Technical details are not publicly available in the provided documents. Monitor for updates from Red Hat/NVD for affected Keycloak FGAP v2 integration and any patched versions.

CVE-2026-14460

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...

CVE-2026-59100

creationtimestamp| type| source ---|---|--- 2026-07-03 15:10:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtdgg4tt2b...

CVE-2026-58578

creationtimestamp| type| source ---|---|--- 2026-07-03 15:09:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtbixkof2w...

Chromium: CVE-2026-14130 Incorrect security UI in Omnibox

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-14017 Inappropriate implementation in Navigation

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-13947 Uninitialized Use in XR

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...