Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
6 / 6 results
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
criticalbug_reportVulnerability8,300+ Gitea servers unpatched against exploited RCE flaw CVE-2026-60004
Gitea versions prior to 1.27.1. Over 8,300 Internet-exposed instances remain vulnerable. Affects self-hosted Gitea installations with default open registration enabled.
criticalbug_reportVulnerabilityGitea CVE-2026-60004 RCE exploited in wild; CISA orders 3-day patch
Gitea self-hosted Git service versions prior to 1.27.1. Approximately 5,000 instances exposed online. Default configurations with self-registration enabled are exploitable by unauthenticated attackers.
criticalbug_reportVulnerabilityGitea CVE-2026-59774: Unauthenticated file read via Org-mode markup
Gitea versions 1.22.1 through 1.27.0. Self-hosted instances with public repositories and Org-mode rendering enabled are vulnerable. Gitea Cloud instances upgraded automatically. Fixed in version 1.27.1.
criticalbug_reportVulnerabilityGitea Docker auth bypass under active probing (CVE-2026-20896)
Gitea Docker images with improper X-WEBAUTH-USER header validation. Specific vulnerable versions not provided; affects deployments trusting reverse proxy authentication headers without IP restrictions.
highbug_reportVulnerabilityGitea auth bypass exposes private container images to unauthenticated users
Gitea versions prior to 1.26.2. All deployments using Gitea's container registry feature are affected. Unauthenticated remote attackers can pull private container images without credentials.