https://vulnerability.circl.lu/sightings/feed 2026-08-07T03:28:37.964658+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/d641158a-1754-4ee3-a228-79d3415c5c54/export 2026-08-07T03:28:37.985201+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d641158a-1754-4ee3-a228-79d3415c5c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3msfzg6qjv72y", "content": "Gitea Vulnerability Enables Remote Code Execution (CVE-2026-59774) #patchmanagement", "creation_timestamp": "2026-08-06T12:15:34.905941Z"} 2026-08-06T12:15:34.905941+00:00 https://vulnerability.circl.lu/sighting/aa1cc6e9-79ed-4eed-8383-682ff2abca80/export 2026-08-07T03:28:37.986964+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "aa1cc6e9-79ed-4eed-8383-682ff2abca80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "content": "An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.\n\nThe file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its", "creation_timestamp": "2026-08-06T01:00:33.994711Z"} 2026-08-06T01:00:33.994711+00:00 https://vulnerability.circl.lu/sighting/90cf6927-63f6-4dd9-9a8e-0264a4e4639e/export 2026-08-07T03:28:37.987114+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "90cf6927-63f6-4dd9-9a8e-0264a4e4639e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9713", "content": "- No login\n- No write access\n- Just crafted Org-mode markup\n\n\ud83d\uded1 CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.\n\nHow it works and what admins should check: https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "creation_timestamp": "2026-08-06T00:00:42.212622Z"} 2026-08-06T00:00:42.212622+00:00 https://vulnerability.circl.lu/sighting/ea20d4b9-a5d7-4a8a-b9aa-efcaa1e27da9/export 2026-08-07T03:28:37.987235+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ea20d4b9-a5d7-4a8a-b9aa-efcaa1e27da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "content": "An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.\n\nThe file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its", "creation_timestamp": "2026-08-05T13:00:36.117690Z"} 2026-08-05T13:00:36.117690+00:00 https://vulnerability.circl.lu/sighting/f8b7aae2-0abd-4725-99b9-ec658940b36e/export 2026-08-07T03:28:37.987345+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f8b7aae2-0abd-4725-99b9-ec658940b36e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3msdjlpgumd2c", "content": "\ud83e\udd16 CVE-2026-59774 (CVSS 9.8): unauthenticated file read in Gitea via crafted Org-mode markup. No login needed, a public repo is enough to read files accessible by the service account. Fixed in 1.27.1.\nhttps://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "creation_timestamp": "2026-08-05T12:27:01.486356Z"} 2026-08-05T12:27:01.486356+00:00 https://vulnerability.circl.lu/sighting/6d14d627-d059-4021-b022-ea5fb35c43b3/export 2026-08-07T03:28:37.987461+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6d14d627-d059-4021-b022-ea5fb35c43b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9713", "content": "- No login\n- No write access\n- Just crafted Org-mode markup\n\n\ud83d\uded1 CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.\n\nHow it works and what admins should check: https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "creation_timestamp": "2026-08-05T12:00:04.600578Z"} 2026-08-05T12:00:04.600578+00:00 https://vulnerability.circl.lu/sighting/5129d4ee-b12d-46fe-be13-65fec3d2341c/export 2026-08-07T03:28:37.987575+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5129d4ee-b12d-46fe-be13-65fec3d2341c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msajuqcla72s", "content": "Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution", "creation_timestamp": "2026-08-04T07:54:05.369348Z"} 2026-08-04T07:54:05.369348+00:00