Digest · Friday
Security digest: July 3, 2026
6 critical advisories.
All digests · RSS · Markdown
Take stock
- Go: 6 critical advisories (
code.gitea.io/gitea). Check withgovulncheck ./.... - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 6
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Go 6
Check: govulncheck ./...
- Gitea pre-receive hook scanner errors allow branch-protection bypass CVE-2026-27780 CVSS 9.8 Critical
code.gitea.io/gitea< 1.26.0 → fixed in 1.26.0 - Gitea LFS mirror operations bypass migration HTTP transport protections CVE-2026-26292 CVSS 9.8 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea OAuth2 PKCE S256 verifier bypass CVE-2026-26247 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea template repository generation follows unsafe filesystem paths CVE-2026-25718 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea repository creation accepts insufficiently validated fields CVE-2026-22547 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5 - Gitea OAuth2 authorization codes can be reused after expiry CVE-2026-26232 CVSS 9.1 Critical
code.gitea.io/gitea< 1.25.5 → fixed in 1.25.5