data/reports: add 10 reports - data/reports/GO-2026-6333.yaml - data/reports/GO-2026-6334.yaml - data/reports/GO-2026-6335.yaml - data/reports/GO-2026-6336.yaml - data/reports/GO-2026-6337.yaml - data/reports/GO-2026-6338.yaml - data/reports/GO-2026-6339.yaml - data/reports/GO-2026-6340.yaml - data/reports/GO-2026-6341.yaml - data/reports/GO-2026-6342.yaml Fixes golang/vulndb#6333 Fixes golang/vulndb#6334 Fixes golang/vulndb#6335 Fixes golang/vulndb#6336 Fixes golang/vulndb#6337 Fixes golang/vulndb#6338 Fixes golang/vulndb#6339 Fixes golang/vulndb#6340 Fixes golang/vulndb#6341 Fixes golang/vulndb#6342 Change-Id: I8ceb32b120ef051040f26332c916722cc97b0284 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/825924 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Neal Patel <neal@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com> Auto-Submit: Ian Alexander <jitsu@google.com>
diff --git a/data/osv/GO-2026-6333.json b/data/osv/GO-2026-6333.json new file mode 100644 index 0000000..493c6e8 --- /dev/null +++ b/data/osv/GO-2026-6333.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6333", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-25712", + "GHSA-37w2-86g3-h4qh" + ], + "summary": "Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea", + "details": "Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-37w2-86g3-h4qh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25712" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/57b5ed3f252753797e790c060c42fbbe8219b9c1" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/96515c0f200d37228dc84a599c6177297a230c94" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36798" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36841" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6333", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6334.json b/data/osv/GO-2026-6334.json new file mode 100644 index 0000000..e7c176c --- /dev/null +++ b/data/osv/GO-2026-6334.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6334", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-24690", + "GHSA-47rq-xp99-92mx" + ], + "summary": "Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea", + "details": "Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-47rq-xp99-92mx" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24690" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/76c539cd572f1638c5a8a6571b0c347b277bf999" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/99b0bf7324dec2f9b85ce33ff809d0cc2acd5864" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36465" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36838" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6334", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6335.json b/data/osv/GO-2026-6335.json new file mode 100644 index 0000000..2c8e9d0 --- /dev/null +++ b/data/osv/GO-2026-6335.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6335", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-27657", + "GHSA-4c8f-3m6h-m56r" + ], + "summary": "Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea", + "details": "Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-4c8f-3m6h-m56r" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27657" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/8d26ea93738430a57d00c2da0fd97e1ba712eed7" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/e927a86586afc138959b462d4040d1547f406f71" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36586" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36607" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6335", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6336.json b/data/osv/GO-2026-6336.json new file mode 100644 index 0000000..a7d20e1 --- /dev/null +++ b/data/osv/GO-2026-6336.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6336", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-26232", + "GHSA-5v69-g2m3-3hq3" + ], + "summary": "Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea", + "details": "Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-5v69-g2m3-3hq3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26232" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/413074b1e1dc5718b4865b9493d8cc97e1e128de" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/f3bdcc58aff60b66eba7bd5e9b23457441733dfe" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36797" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36851" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6336", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6337.json b/data/osv/GO-2026-6337.json new file mode 100644 index 0000000..62678de --- /dev/null +++ b/data/osv/GO-2026-6337.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6337", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-28705", + "GHSA-7jvx-g65v-r899" + ], + "summary": "Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea", + "details": "Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-7jvx-g65v-r899" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28705" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/833304ac15bce17d0f03c4852af5f60c186f6a70" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/f7ac5076711af3a260f3f98b2c1f8c19b32f6d09" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36799" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36839" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6337", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6338.json b/data/osv/GO-2026-6338.json new file mode 100644 index 0000000..ab0248e --- /dev/null +++ b/data/osv/GO-2026-6338.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6338", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-22547", + "GHSA-922f-hfwp-p56f" + ], + "summary": "Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea", + "details": "Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-922f-hfwp-p56f" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22547" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/569c49debe06f30a2bbb50b3812e705c556b8adf" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/b3bc79262d106f4259f82a26609e4738b618152b" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36671" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36757" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6338", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6339.json b/data/osv/GO-2026-6339.json new file mode 100644 index 0000000..edd52d6 --- /dev/null +++ b/data/osv/GO-2026-6339.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6339", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-20909", + "GHSA-fhq3-p242-2qpf" + ], + "summary": "Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea", + "details": "Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-fhq3-p242-2qpf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20909" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/00566cc953dba772d2f38aa475d235fead461605" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/ed57c70176a6cac63f48ddf6b0d5f4f72cfea963" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36662" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36744" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6339", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6340.json b/data/osv/GO-2026-6340.json new file mode 100644 index 0000000..bfff3b7 --- /dev/null +++ b/data/osv/GO-2026-6340.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6340", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-25718", + "GHSA-h697-89cp-24q8" + ], + "summary": "Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea", + "details": "Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-h697-89cp-24q8" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25718" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2bc3f3a9066020cc674f6b1" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/579615936c1ef7ba16c8887b9d12ade4c44f78fa" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36734" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36746" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6340", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6341.json b/data/osv/GO-2026-6341.json new file mode 100644 index 0000000..3ccc1c7 --- /dev/null +++ b/data/osv/GO-2026-6341.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6341", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-26307", + "GHSA-h9c5-x7g8-4q7f" + ], + "summary": "Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea", + "details": "Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-h9c5-x7g8-4q7f" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26307" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/5d87bb3d4566e71b791a8114bfc9e25c037ab5fe" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/f7e3569fab57d3525280670dffcc30c84c87b115" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36809" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36835" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6341", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6342.json b/data/osv/GO-2026-6342.json new file mode 100644 index 0000000..1719739 --- /dev/null +++ b/data/osv/GO-2026-6342.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6342", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-26247", + "GHSA-m5ch-ppfx-xv3v" + ], + "summary": "Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea", + "details": "Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea", + "affected": [ + { + "package": { + "name": "code.gitea.io/gitea", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.25.5" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-m5ch-ppfx-xv3v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26247" + }, + { + "type": "WEB", + "url": "https://blog.gitea.com/release-of-1.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36462" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/pull/36477" + }, + { + "type": "WEB", + "url": "https://github.com/go-gitea/gitea/releases/tag/v1.25.5" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6342", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-6333.yaml b/data/reports/GO-2026-6333.yaml new file mode 100644 index 0000000..f3a2d3f --- /dev/null +++ b/data/reports/GO-2026-6333.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-6333 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: |- + Gitea organization permission APIs expose hidden membership and private + organization data in code.gitea.io/gitea +cves: + - CVE-2026-25712 +ghsas: + - GHSA-37w2-86g3-h4qh +references: + - advisory: https://github.com/advisories/GHSA-37w2-86g3-h4qh + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-25712 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/57b5ed3f252753797e790c060c42fbbe8219b9c1 + - web: https://github.com/go-gitea/gitea/commit/96515c0f200d37228dc84a599c6177297a230c94 + - web: https://github.com/go-gitea/gitea/pull/36798 + - web: https://github.com/go-gitea/gitea/pull/36841 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-37w2-86g3-h4qh + created: 2026-09-01T14:12:33.994612-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6334.yaml b/data/reports/GO-2026-6334.yaml new file mode 100644 index 0000000..5b497d1 --- /dev/null +++ b/data/reports/GO-2026-6334.yaml
@@ -0,0 +1,26 @@ +id: GO-2026-6334 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: |- + Gitea pull request branch permission checks allow unauthorized updates and + rebases in code.gitea.io/gitea +cves: + - CVE-2026-24690 +ghsas: + - GHSA-47rq-xp99-92mx +references: + - advisory: https://github.com/advisories/GHSA-47rq-xp99-92mx + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-24690 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/76c539cd572f1638c5a8a6571b0c347b277bf999 + - web: https://github.com/go-gitea/gitea/commit/99b0bf7324dec2f9b85ce33ff809d0cc2acd5864 + - web: https://github.com/go-gitea/gitea/pull/36465 + - web: https://github.com/go-gitea/gitea/pull/36838 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-47rq-xp99-92mx + created: 2026-09-01T14:12:24.787213-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6335.yaml b/data/reports/GO-2026-6335.yaml new file mode 100644 index 0000000..adc1c3d --- /dev/null +++ b/data/reports/GO-2026-6335.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6335 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea +cves: + - CVE-2026-27657 +ghsas: + - GHSA-4c8f-3m6h-m56r +references: + - advisory: https://github.com/advisories/GHSA-4c8f-3m6h-m56r + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-27657 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/8d26ea93738430a57d00c2da0fd97e1ba712eed7 + - web: https://github.com/go-gitea/gitea/commit/e927a86586afc138959b462d4040d1547f406f71 + - web: https://github.com/go-gitea/gitea/pull/36586 + - web: https://github.com/go-gitea/gitea/pull/36607 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-4c8f-3m6h-m56r + created: 2026-09-01T14:12:15.907211-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6336.yaml b/data/reports/GO-2026-6336.yaml new file mode 100644 index 0000000..fb00288 --- /dev/null +++ b/data/reports/GO-2026-6336.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6336 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea +cves: + - CVE-2026-26232 +ghsas: + - GHSA-5v69-g2m3-3hq3 +references: + - advisory: https://github.com/advisories/GHSA-5v69-g2m3-3hq3 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-26232 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/413074b1e1dc5718b4865b9493d8cc97e1e128de + - web: https://github.com/go-gitea/gitea/commit/f3bdcc58aff60b66eba7bd5e9b23457441733dfe + - web: https://github.com/go-gitea/gitea/pull/36797 + - web: https://github.com/go-gitea/gitea/pull/36851 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-5v69-g2m3-3hq3 + created: 2026-09-01T14:12:07.08622-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6337.yaml b/data/reports/GO-2026-6337.yaml new file mode 100644 index 0000000..76f9e21 --- /dev/null +++ b/data/reports/GO-2026-6337.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6337 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea +cves: + - CVE-2026-28705 +ghsas: + - GHSA-7jvx-g65v-r899 +references: + - advisory: https://github.com/advisories/GHSA-7jvx-g65v-r899 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-28705 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/833304ac15bce17d0f03c4852af5f60c186f6a70 + - web: https://github.com/go-gitea/gitea/commit/f7ac5076711af3a260f3f98b2c1f8c19b32f6d09 + - web: https://github.com/go-gitea/gitea/pull/36799 + - web: https://github.com/go-gitea/gitea/pull/36839 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-7jvx-g65v-r899 + created: 2026-09-01T14:11:58.369583-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6338.yaml b/data/reports/GO-2026-6338.yaml new file mode 100644 index 0000000..31a6f5c --- /dev/null +++ b/data/reports/GO-2026-6338.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6338 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea +cves: + - CVE-2026-22547 +ghsas: + - GHSA-922f-hfwp-p56f +references: + - advisory: https://github.com/advisories/GHSA-922f-hfwp-p56f + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-22547 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/569c49debe06f30a2bbb50b3812e705c556b8adf + - web: https://github.com/go-gitea/gitea/commit/b3bc79262d106f4259f82a26609e4738b618152b + - web: https://github.com/go-gitea/gitea/pull/36671 + - web: https://github.com/go-gitea/gitea/pull/36757 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-922f-hfwp-p56f + created: 2026-09-01T14:11:49.762315-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6339.yaml b/data/reports/GO-2026-6339.yaml new file mode 100644 index 0000000..392d049 --- /dev/null +++ b/data/reports/GO-2026-6339.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6339 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea +cves: + - CVE-2026-20909 +ghsas: + - GHSA-fhq3-p242-2qpf +references: + - advisory: https://github.com/advisories/GHSA-fhq3-p242-2qpf + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-20909 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/00566cc953dba772d2f38aa475d235fead461605 + - web: https://github.com/go-gitea/gitea/commit/ed57c70176a6cac63f48ddf6b0d5f4f72cfea963 + - web: https://github.com/go-gitea/gitea/pull/36662 + - web: https://github.com/go-gitea/gitea/pull/36744 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-fhq3-p242-2qpf + created: 2026-09-01T14:11:41.58435-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6340.yaml b/data/reports/GO-2026-6340.yaml new file mode 100644 index 0000000..e4d2bd2 --- /dev/null +++ b/data/reports/GO-2026-6340.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6340 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea +cves: + - CVE-2026-25718 +ghsas: + - GHSA-h697-89cp-24q8 +references: + - advisory: https://github.com/advisories/GHSA-h697-89cp-24q8 + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-25718 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2bc3f3a9066020cc674f6b1 + - web: https://github.com/go-gitea/gitea/commit/579615936c1ef7ba16c8887b9d12ade4c44f78fa + - web: https://github.com/go-gitea/gitea/pull/36734 + - web: https://github.com/go-gitea/gitea/pull/36746 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-h697-89cp-24q8 + created: 2026-09-01T14:11:32.695306-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6341.yaml b/data/reports/GO-2026-6341.yaml new file mode 100644 index 0000000..28fc130 --- /dev/null +++ b/data/reports/GO-2026-6341.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6341 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea +cves: + - CVE-2026-26307 +ghsas: + - GHSA-h9c5-x7g8-4q7f +references: + - advisory: https://github.com/advisories/GHSA-h9c5-x7g8-4q7f + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-26307 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/5d87bb3d4566e71b791a8114bfc9e25c037ab5fe + - web: https://github.com/go-gitea/gitea/commit/f7e3569fab57d3525280670dffcc30c84c87b115 + - web: https://github.com/go-gitea/gitea/pull/36809 + - web: https://github.com/go-gitea/gitea/pull/36835 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-h9c5-x7g8-4q7f + created: 2026-09-01T14:11:24.089626-04:00 +review_status: UNREVIEWED
diff --git a/data/reports/GO-2026-6342.yaml b/data/reports/GO-2026-6342.yaml new file mode 100644 index 0000000..6acab40 --- /dev/null +++ b/data/reports/GO-2026-6342.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6342 +modules: + - module: code.gitea.io/gitea + versions: + - fixed: 1.25.5 + vulnerable_at: 1.25.4 +summary: Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea +cves: + - CVE-2026-26247 +ghsas: + - GHSA-m5ch-ppfx-xv3v +references: + - advisory: https://github.com/advisories/GHSA-m5ch-ppfx-xv3v + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-26247 + - web: https://blog.gitea.com/release-of-1.25.5 + - web: https://github.com/go-gitea/gitea/commit/750649c1ef092c95f95b206b9d5fa17471a0b1f5 + - web: https://github.com/go-gitea/gitea/commit/bf8d11bb212ba2a76596d8a90e74e7d664571324 + - web: https://github.com/go-gitea/gitea/pull/36462 + - web: https://github.com/go-gitea/gitea/pull/36477 + - web: https://github.com/go-gitea/gitea/releases/tag/v1.25.5 +source: + id: GHSA-m5ch-ppfx-xv3v + created: 2026-09-01T14:11:14.309433-04:00 +review_status: UNREVIEWED