Medium, CVSS 5.3
Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-55982 · GHSA-mg4f-x9v4-6h2p
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
26–50 of 86 matching · newest first
- Low, CVSS 2.3
Gitea: Private Repository Metadata Remains Accessible After Access Revocation
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58434 · GHSA-j2w3-9c3r-g83q
- High, CVSS 7.5
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-54481 · GHSA-94v3-77j7-vm48
- Medium, CVSS 4.3
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-50105 · GHSA-6cqf-375w-639g
- Medium, CVSS 6.5
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-42931 · GHSA-wwqq-x6w4-frm2
- Low, CVSS 2.7
Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58445 · GHSA-pgqf-926r-548m
- Medium, CVSS 4.3
Gitea: Personal access token scope enforcement bypass on the repository home page (
GET /{owner}/{repo}) discloses private repository contentsGo code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58444 · GHSA-cp3q-vrj2-ghhh
- Critical, CVSS 9.6
Gitea: Public-only repository tokens can update private PR head branches
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58443 · GHSA-xxjv-752h-3vp2
- Medium, CVSS 6.5
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58442 · GHSA-h2x6-g7q6-344v
- Medium, CVSS 6.3
Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58441 · GHSA-xmj7-xj85-hfc3
- High, CVSS 8.9
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-58424 · GHSA-777r-4v59-6486
- High, CVSS 7.7
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · >= 1.23.0, < 1.26.3 · CVE-2026-58423 · GHSA-7wvc-rvp7-w99x
- Medium, CVSS 4.3
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · <= 1.26.2 · CVE-2026-27761 · GHSA-3pww-vcvm-3gmj
- Critical, CVSS 9.8
Gitea Docker image:
REVERSE_PROXY_TRUSTED_PROXIES = *default lets any source IP impersonate any user viaX-WEBAUTH-USERGo code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-20896 · GHSA-f75j-4cw6-rmx4
- Critical, CVSS 9.6
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-22874 · GHSA-2r5c-gw76-rh3w
- High, CVSS 8.7
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56654 · GHSA-683j-3ff6-hh2x
- High, CVSS 7.1
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56755 · GHSA-6hm7-3pwj-22rm
- Medium, CVSS 5.3
Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58507 · GHSA-p4mj-98mv-xq26
- Medium, CVSS 5.9
Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-57886 · GHSA-6c6r-5xr4-cr5m
- Low, CVSS 3.1
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-23603 · GHSA-x77v-q46j-393g
- Medium, CVSS 4.3
Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58425 · GHSA-vxv2-8j6r-pcpg
- Medium, CVSS 5.3
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-59763 · GHSA-9mq6-mqjj-c2c5
- Critical, CVSS 9.1
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56750 · GHSA-rgv6-xp99-6mgj
- Medium, CVSS 5.9
Gitea: draft release attachment disclosure via missing web authorization
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58432 · GHSA-q9pg-jj6x-j9p6
- Medium, CVSS 6.5
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58428 · GHSA-25gq-j9jx-43pg
A vendor fix does not resolve your finding until you verify it in your own systems.