Security advisories

medium2026-07-21

CVE-2026-73490-Loofah: SVG `href` attribute bypasses local-reference restriction

flavorjones/loofah · GHSA-9wjq-cp2p-hrgf

medium2026-07-21

CVE-2026-59889-jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

fasterxml/jackson-databind · GHSA-5gvw-p9qm-jgwh

medium2026-07-21

CVE-2026-73651- TypeORM: migration:generate template-literal code injection

typeorm/typeorm · GHSA-2rp8-mm9q-fp49

high2026-07-21

CVE-2026-68494-jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

fasterxml/jackson-core · GHSA-r7wm-3cxj-wff9

high2026-07-21

CVE-2026-20779-Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

go-gitea/gitea · GHSA-gx3v-q759-g323

medium2026-07-21

CVE-2026-58429-Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

go-gitea/gitea · GHSA-fq2p-5p22-8g6j

medium2026-07-21

CVE-2026-59765-Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

go-gitea/gitea · GHSA-2wm4-vwp6-v7xc

low2026-07-21

CVE-2026-58511-Gitea: Webhook Authorization Header Returned in Plaintext via API

go-gitea/gitea · GHSA-3r5c-2xxx-h872

medium2026-07-21

CVE-2026-57897-Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

go-gitea/gitea · GHSA-frpw-3h2q-4jj6

medium2026-07-21

CVE-2026-58510-Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

go-gitea/gitea · GHSA-q423-49rw-g9mh

medium2026-07-21

CVE-2026-58431-Gitea: Public-only API token restriction is not enforced on team API routes

go-gitea/gitea · GHSA-h56g-4qw7-2mxg

medium2026-07-21

CVE-2026-58427-Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

go-gitea/gitea · GHSA-prr9-9mp4-5gp2

high2026-07-21

CVE-2026-58422-Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

go-gitea/gitea · GHSA-g9g6-qhrc-p3qc

high2026-07-21

CVE-2026-58419-Gitea: Notification API leaks private issue metadata after access revocation

go-gitea/gitea · GHSA-44qc-pgvp-wx7v

high2026-07-21

CVE-2026-25038-Gitea: Unauthorized Access to Labels of Private Organizations

go-gitea/gitea · GHSA-v73x-hx65-6pf4

high2026-07-21

CVE-2026-27775-Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

go-gitea/gitea · GHSA-649p-mmhf-85c7

high2026-07-21

CVE-2026-24451-Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

go-gitea/gitea · GHSA-wrf9-r3h7-7x5v

high2026-07-21

CVE-2026-58314-Gitea: Two SSRF findings

go-gitea/gitea · GHSA-2fcr-jfvc-vgg2

high2026-07-21

CVE-2026-58436-Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

go-gitea/gitea · GHSA-fw57-jgch-pgf3

medium2026-07-21

CVE-2026-56657-Gitea SSH Key Parser Denial of Service

go-gitea/gitea · GHSA-4xjf-493q-98p3