Skip to content

Commit 1dad469

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-pv4c-p2j5-38j4 GHSA-2vgv-hgv4-22mh GHSA-8fwc-qjw5-rvgp GHSA-hgr3-x44x-33hx GHSA-j8xr-c56q-m8jj
1 parent e3aa49c commit 1dad469

5 files changed

Lines changed: 163 additions & 43 deletions

File tree

‎advisories/github-reviewed/2018/08/GHSA-pv4c-p2j5-38j4/GHSA-pv4c-p2j5-38j4.json‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-pv4c-p2j5-38j4",
4-
"modified": "2026-01-23T17:42:20Z",
4+
"modified": "2026-01-23T20:10:56Z",
55
"published": "2018-08-13T15:02:15Z",
66
"aliases": [
77
"CVE-2018-3774"
@@ -25,7 +25,7 @@
2525
"type": "ECOSYSTEM",
2626
"events": [
2727
{
28-
"introduced": "0.1.0"
28+
"introduced": "1.0.0"
2929
},
3030
{
3131
"fixed": "1.4.3"
@@ -40,6 +40,10 @@
4040
"type": "ADVISORY",
4141
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3774"
4242
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/unshiftio/url-parse/commit/209c296d302317268afbe19700a70c63ecbeb2d2"
46+
},
4347
{
4448
"type": "WEB",
4549
"url": "https://github.com/unshiftio/url-parse/commit/53b1794e54d0711ceb52505e0f74145270570d5a"
@@ -58,7 +62,7 @@
5862
},
5963
{
6064
"type": "WEB",
61-
"url": "https://github.com/unshiftio/url-parse/compare/0.0.4...0.1.0"
65+
"url": "https://github.com/unshiftio/url-parse/compare/0.2.3...1.0.0"
6266
}
6367
],
6468
"database_specific": {

advisories/unreviewed/2026/01/GHSA-2vgv-hgv4-22mh/GHSA-2vgv-hgv4-22mh.json renamed to advisories/github-reviewed/2026/01/GHSA-2vgv-hgv4-22mh/GHSA-2vgv-hgv4-22mh.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-2vgv-hgv4-22mh",
4-
"modified": "2026-01-23T00:31:16Z",
4+
"modified": "2026-01-23T20:11:50Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-20800"
88
],
9+
"summary": "Gitea improperly exposes issue and pull request titles",
910
"details": "Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a private repository is revoked, they may still view issue and pull request titles through previously received notifications.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-g54m-9f6g-wj7q"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20800"
@@ -22,10 +44,18 @@
2244
"type": "WEB",
2345
"url": "https://github.com/go-gitea/gitea/pull/36339"
2446
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/go-gitea/gitea/commit/67e75f30a83d2523cedc37ad7b03bcba66947833"
50+
},
2551
{
2652
"type": "WEB",
2753
"url": "https://blog.gitea.com/release-of-1.25.4"
2854
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/go-gitea/gitea"
58+
},
2959
{
3060
"type": "WEB",
3161
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -35,9 +65,9 @@
3565
"cwe_ids": [
3666
"CWE-200"
3767
],
38-
"severity": null,
39-
"github_reviewed": false,
40-
"github_reviewed_at": null,
68+
"severity": "LOW",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-01-23T20:11:50Z",
4171
"nvd_published_at": "2026-01-22T22:16:17Z"
4272
}
4373
}

advisories/unreviewed/2026/01/GHSA-8fwc-qjw5-rvgp/GHSA-8fwc-qjw5-rvgp.json renamed to advisories/github-reviewed/2026/01/GHSA-8fwc-qjw5-rvgp/GHSA-8fwc-qjw5-rvgp.json

Lines changed: 36 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-8fwc-qjw5-rvgp",
4-
"modified": "2026-01-23T00:31:16Z",
4+
"modified": "2026-01-23T20:11:25Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-0798"
88
],
9+
"summary": "Gitea may send release notification emails for private repositories to users whose access has been revoked",
910
"details": "Gitea may send release notification emails for private repositories to users whose access has been revoked. When a repository is changed from public to private, users who previously watched the repository may continue to receive release notifications, potentially disclosing release titles, tags, and content.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-f4wq-6ww5-m56p"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0798"
@@ -26,6 +48,10 @@
2648
"type": "WEB",
2749
"url": "https://blog.gitea.com/release-of-1.25.4"
2850
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/go-gitea/gitea"
54+
},
2955
{
3056
"type": "WEB",
3157
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -35,9 +61,9 @@
3561
"cwe_ids": [
3662
"CWE-284"
3763
],
38-
"severity": null,
39-
"github_reviewed": false,
40-
"github_reviewed_at": null,
64+
"severity": "LOW",
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2026-01-23T20:11:25Z",
4167
"nvd_published_at": "2026-01-22T22:16:15Z"
4268
}
4369
}

advisories/unreviewed/2026/01/GHSA-hgr3-x44x-33hx/GHSA-hgr3-x44x-33hx.json renamed to advisories/github-reviewed/2026/01/GHSA-hgr3-x44x-33hx/GHSA-hgr3-x44x-33hx.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-hgr3-x44x-33hx",
4-
"modified": "2026-01-23T00:31:16Z",
4+
"modified": "2026-01-23T20:11:37Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-20736"
88
],
9+
"summary": "Gitea has improper access control for uploaded attachments",
910
"details": "Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jr6h-pwwp-c8g6"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20736"
@@ -22,10 +44,18 @@
2244
"type": "WEB",
2345
"url": "https://github.com/go-gitea/gitea/pull/36320"
2446
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/go-gitea/gitea/commit/fbea2c68e8df11cfa94e8ead913b79946780ed30"
50+
},
2551
{
2652
"type": "WEB",
2753
"url": "https://blog.gitea.com/release-of-1.25.4"
2854
},
55+
{
56+
"type": "PACKAGE",
57+
"url": "https://github.com/go-gitea/gitea"
58+
},
2959
{
3060
"type": "WEB",
3161
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
@@ -35,9 +65,9 @@
3565
"cwe_ids": [
3666
"CWE-284"
3767
],
38-
"severity": null,
39-
"github_reviewed": false,
40-
"github_reviewed_at": null,
68+
"severity": "LOW",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-01-23T20:11:37Z",
4171
"nvd_published_at": "2026-01-22T22:16:17Z"
4272
}
4373
}

advisories/unreviewed/2026/01/GHSA-j8xr-c56q-m8jj/GHSA-j8xr-c56q-m8jj.json renamed to advisories/github-reviewed/2026/01/GHSA-j8xr-c56q-m8jj/GHSA-j8xr-c56q-m8jj.json

Lines changed: 40 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,41 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j8xr-c56q-m8jj",
4-
"modified": "2026-01-23T00:31:16Z",
4+
"modified": "2026-01-23T20:11:59Z",
55
"published": "2026-01-23T00:31:16Z",
66
"aliases": [
77
"CVE-2026-20883"
88
],
9+
"summary": "Gitea improperly exposes issue titles and repository names through previously started stopwatches",
910
"details": "Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may still view issue titles and repository names through previously started stopwatches.",
10-
"severity": [],
11-
"affected": [],
12-
"references": [
11+
"severity": [
1312
{
14-
"type": "WEB",
15-
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg"
16-
},
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/go-gitea/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.25.4"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
1739
{
1840
"type": "ADVISORY",
1941
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20883"
@@ -26,22 +48,30 @@
2648
"type": "WEB",
2749
"url": "https://github.com/go-gitea/gitea/pull/36368"
2850
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/go-gitea/gitea/commit/95ea2df00a70176c516b12f3cfee8c84a310280f"
54+
},
2955
{
3056
"type": "WEB",
3157
"url": "https://blog.gitea.com/release-of-1.25.4"
3258
},
3359
{
3460
"type": "WEB",
3561
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.4"
62+
},
63+
{
64+
"type": "PACKAGE",
65+
"url": "https://pkg.go.dev/github.com/go-gitea/gitea"
3666
}
3767
],
3868
"database_specific": {
3969
"cwe_ids": [
4070
"CWE-284"
4171
],
42-
"severity": null,
43-
"github_reviewed": false,
44-
"github_reviewed_at": null,
72+
"severity": "LOW",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-01-23T20:11:59Z",
4575
"nvd_published_at": "2026-01-22T22:16:17Z"
4676
}
4777
}

0 commit comments

Comments
 (0)