Gitea -- multiple vulnerabilities

2026-09-13 · CVE-2026-66877, CVE-2026-71184, CVE-2026-68957, CVE-2026-60010, CVE-2026-70406, CVE-2026-63792, CVE-2026-66874, CVE-2026-68964, CVE-2026-67577, CVE-2026-66849, CVE-2026-73135, CVE-2026-78433, CVE-2026-70407, CVE-2026-73126, CVE-2026-70400, CVE-2026-70396, CVE-2026-63021, CVE-2026-62925, CVE-2026-73273, CVE-2026-60021, CVE-2026-60018, CVE-2026-73130, CVE-2026-70402, CVE-2026-66853, CVE-2026-71301, CVE-2026-73504 · VuXML entry

Gitea reports: This release contains fixes for 26 security issues, hardens issue searching that an unfiltered query no longer enumerates every public repository into the indexer filter and removes unsafe code from the internal private endpoints. Please upgrade as soon as possible.

Affected versions

• gitea < 1.27.3

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.