gitea.dev

6 results · Clear filters · Feed

• Critical 9.8
  CVE-2026-60004 Exploited Public exploit EPSS 24%

  Gitea: Remote Code Execution via diffpatch Git Hook Installation

  Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

  Gitea Gitea code.gitea.io/gitea gitea.dev Alpine Go
  Aug 26, 2026

  KEV Aug 25, 2026
• Critical 9.1
  CVE-2026-58443

  Public-only repository tokens can update private PR head branches

  Public-only repository tokens can update private PR head branches

  Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  Aug 13, 2026
• Critical 9.1
  CVE-2026-56750

  Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  Gitea Remember-Me Token Theft Not Invalidating Attacker Session

  Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  Aug 13, 2026
• Critical 9.6
  CVE-2026-56443

  Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

  Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  Aug 13, 2026
• Critical 9.8
  CVE-2026-56654

  Privilege Escalation via Access Token Scope Escalation in API

  Privilege Escalation via Access Token Scope Escalation in API

  Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  Aug 13, 2026
• Critical 9.1
  CVE-2026-55982

  OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

  Gitea Gitea Open Source Git Server code.gitea.io/gitea gitea.dev Go
  Aug 13, 2026