#gitea
-
Red Heron Breaches 13 Organizations Through a Gitea Vulnerability
In a matter of days, the presumed Chinese group Red Heron turned a public Gitea exploit into an automated tool and struck targets across six countries.
-
Critical RCE Vulnerability in Gitea Already Being Exploited for Cryptojacking
CISA has warned of active attacks against CVE-2026-60004 in Gitea. Rated 9.8, the flaw allows arbitrary command execution, and the first victims have found a miner-like payload on their servers.
-
Critical Gitea Vulnerability: Reading Server Files via Org Markup Without Logging In
In Gitea versions 1.22.1 through 1.27.0, an unauthenticated attacker could read any file accessible to the service account. All it took was a public repository and specially crafted Org markup.
-
Hackers Are Attacking a Critical Vulnerability in the Gitea Docker Image
Attackers are actively exploiting a critical vulnerability in the official Docker image of the self-hosted Gitea service that allows them to impersonate any user, including administrators.