Advisory Catalog

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the

Gitea: Two SSRF findings

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea SSH Key Parser Denial of Service

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea LFS Deploy-Key Privilege Escalation

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Gitea: Private Repository Metadata Remains Accessible After Access Revocation

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: REST API exposes organization membership of private organizations to public

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Gitea: Public-only repository tokens can update private PR head branches

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Gitea: SSRF via HTTP Redirect in Repository Migration

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea: draft release attachment disclosure via missing web authorization

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist