Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Gitea CVE-2026-120263
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing acco
4 CVEs and 4 credit lines. None claimed yet.
0 of 4 credit lines claimed Claim credit -
Gitea CVE-2026-119627
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without consid
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-119625
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope,
5 CVEs and 5 credit lines. None claimed yet.
0 of 5 credit lines claimed Claim credit -
Gitea CVE-2026-119533
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. Wh
4 CVEs and 4 credit lines. None claimed yet.
0 of 4 credit lines claimed Claim credit -
Gitea CVE-2026-119441
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route on
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-118504
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-118395
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POS
5 CVEs and 5 credit lines. None claimed yet.
0 of 5 credit lines claimed Claim credit -
Gitea CVE-2026-118394
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` hea
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-118386
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the review
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-117685
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only agains
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-117677
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed si
3 CVEs and 3 credit lines. None claimed yet.
0 of 3 credit lines claimed Claim credit -
Gitea CVE-2026-117649
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependen
7 CVEs and 7 credit lines. None claimed yet.
0 of 7 credit lines claimed Claim credit -
Gitea CVE-2026-117646
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-117635
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site a
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-116474
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-116296
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an ar
2 CVEs and 2 credit lines. None claimed yet.
0 of 2 credit lines claimed Claim credit -
Gitea CVE-2026-116289
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and t
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-114199
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction o
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-113429
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit -
Gitea CVE-2026-112887
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treat
1 CVE and 1 credit line. Not claimed yet.
0 of 1 credit line claimed Claim credit
-
Gitea gitea-2026-10
Gitea Security Releases - October 2026
77 CVEs and 77 credit lines. None claimed yet.
0 of 77 credit lines claimed Claim credit