gitea

Chrome 157 states 213 security fixes and Rails 21 security issues, while Gitea 28.3's post states no total and lists 21 CVE entries; Linuxiac reported 20 for Gitea.

Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.

CISA added Gitea's CVE-2026-60004 remote code execution flaw to its KEV catalog after BleepingComputer reported attackers deploying cryptomining malware on unpatched servers.

A CVSS 9.8 Gitea flaw let unauthenticated users read server files via Org-mode markup; XBOW Security's autonomous system found it.

A critical Gitea vulnerability lets a repository writer convert a crafted patch into a live Git hook and run shell commands as the service account.