Gitea

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenSep 8, 2026
Last mentionedOct 8, 2026

Timeline

5 articles · newest first

Critical Gitea Vulnerabilities Allow Attackers to Bypass Authentication and Execute Code

Gitea 28.0.0 patches 20 flaws, including SSH impersonation, workflow approval bypasses, and SSRF.

GBHackersOct 8, 10:57 UTC · Oct 8, 2026VulnerabilityCVE-2026-103059 CVE-2026-96404 CVE-2026-104632+612 · 3 reads

Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF

Gitea 28.0.0 and 28.1.0 patch 27 flaws, including a CVSS 9.1 SSH authentication bypass.

Cyber Security NewsOct 8, 10:56 UTC · Oct 8, 2026VulnerabilityCVE-2026-103059 CVE-2026-70357 CVE-2026-101027+48 · 3 reads

Gitea 28.0

Gitea 28.0 adds audit logs and bot accounts, withholding security-fix details for about a week.

Hacker News · AISep 30, 20:32 UTC · Sep 30, 2026Tools HN 43 points · 15 comments1

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.

GreyNoiseSep 21, 00:00 UTC · Sep 21, 2026Threat actorExploitedCVE-2026-7273 CVE-2026-34908 CVE-2026-34909+93 · 1 read

Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...

CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.

Web discovery (articles for new exploits & KEV entries)Sep 8, 09:18 UTC · Sep 8, 2026VulnerabilityCVE-2026-6000415 · 4 reads

Related CVEs

by mentions

CVE-2026-6000424%9.8
Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
published Aug 26, 2026GiteaKEVPoC ×5
CVE-2026-94205<1%9.8
Unapproved fork workflow execution in Gitea Actions
published Oct 6, 2026GiteaPoC
CVE-2026-1030599.1
Case-insensitive SSH key authentication bypass in Gitea
published Oct 6, 2026Gitea
CVE-2026-1046328.8
Gitea Actions rerun bypasses fork-PR approval
published Oct 6, 2026Gitea (Actions)
CVE-2026-1010277.7
Migration allowlist DNS bypass to internal services in Gitea
published Oct 6, 2026Gitea
CVE-2026-703577.5
DNS rebinding SSRF in Gitea repository migration
published Oct 6, 2026Gitea
CVE-2026-101029<1%4.3
DNS multi-answer SSRF bypass in Gitea migrations
published Oct 6, 2026GiteaPoC
CVE-2026-3491090%10.0
Unauthenticated Command Injection in Ubiquiti UniFi OS Devices
published May 22, 2026Ubiquiti (ui) UniFi OSKEVPoC
CVE-2026-894308.1
Gitea push-mirror TOCTOU bypasses migration address filters
published Oct 6, 2026Gitea
CVE-2026-1036675.4
Stored XSS in Gitea container registry blob downloads
published Oct 6, 2026Gitea

Appears with

Giteaproduct · 5
Giteavendor · 5
Gitea Actionsproduct · 2
GreyNoiseorganization · 1
Red Heronthreat actor · 1
Ubiquitivendor · 1
FlowiseAIproduct · 1
Proxmoxorganization · 1
Gitvendor · 1
ZyXELorganization · 1
Nuclioproduct · 1
WordPressproduct · 1
Russian state entityvictim · 1
WordPressorganization · 1
ZyXELvendor · 1
PAN-OS GlobalProtectproduct · 1

Entities are extracted by the model from each article. First seen Sep 8, 2026, last mentioned Oct 8, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.