In Gitea versions prior to 28.2.0 a high severity vulnerability CVE-2026-109553 was detected. This vulnerability allows an attacker to authenticate as another user by registering that user’s public key as their own principal when a user certificate authority is trusted. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-109553.
Read more Developer Tools
In Blaze Demo Importer component for WordPress versions 1.0.16 and earlier a medium severity vulnerability CVE-2026-106933 was detected. This vulnerability allows authenticated users with the Author role or higher to upload a crafted SVG file that executes arbitrary JavaScript in the browser of any user who opens it. To address this issue, users should upgrade Blaze Demo Importer to version 1.0.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-106933.
Read more CMS
In Gitea versions prior to 28.2.0 a medium severity vulnerability CVE-2026-104627 was detected. This vulnerability allows an attacker-controlled OpenID provider to attach the attacker’s identity to a victim’s account and then sign in as the victim, bypassing TOTP and WebAuthn checks. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-104627.
Read more Developer Tools
In Bootstrap Shortcodes component for WordPress versions prior to 3.4.6 a medium severity vulnerability CVE-2026-112111 was detected. This vulnerability allows authenticated users with Contributor-level access or higher to inject arbitrary web script that runs in the browser of any user viewing the page. To address this issue, users should upgrade Bootstrap Shortcodes to version 3.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-112111.
Read more CMS
In Gitea versions prior to 28.2.0 a medium severity vulnerability CVE-2026-105964 was detected. This vulnerability allows a user holding a workflow runner token to exhaust server memory and crash the Gitea process by sending an oversized request to the artifact service. To address this issue, users should upgrade Gitea to version 28.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-105964.
Read more Developer Tools
In affected versions of Gitea a high severity vulnerability CVE-2026-107618 was detected. This vulnerability allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack, resulting in the unauthorized modification of a repository’s topics. This occurs because the POST /{owner}/{repo}/topics endpoint was registered without the necessary sign-in middleware that enforces cross-origin protection. Consequently, if an authenticated repository administrator is tricked into visiting a malicious third-party webpage, the site can forge and send a valid request to alter the repository’s topics without the user’s consent. Note that no other repository settings are reachable or modifiable through this specific route. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-107618.