Gitea

Attackers are currently exploiting a critical-severity vulnerability found in the Gitea self-hosted Git service. The flaw involves code injection attacks, according to information provided by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of active exploitation efforts targeting Gitea. The critical security flaw is identified as CVE-2026-60004, which allows for remote code execution. This vulnerability permits an attacker with ordinary write access to a repository to execute arbitrary shell commands.

An unauthenticated attacker could exploit a critical flaw in Gitea versions 1.22.1 through 1.27.0 to read any file accessible by the service account. The vulnerability, tracked as CVE-2026-59774, requires only a public repository and crafted Org-mode markup. The issue was fixed in Gitea 1.27.1.

A security flaw in Gitea, an open-source version control platform, allows unauthenticated attackers to access private container images. The vulnerability, CVE-2026-27771, affects all versions prior to 1.26.2 and was disclosed by cybersecurity researchers.

Posthorn is a self-hosted email gateway designed to simplify transactional email setup for self-hosted applications. It addresses challenges like VPS SMTP port restrictions and offers features such as HTTP POST support, anti-spam measures, and integration with providers like Postmark and Amazon SES. The open-source project is available under Apache 2.0.

The article discusses a follow-up to a previous disclosure by Carrot, a company, regarding its use of Forgejo, an open-source project forked from Gitea. It highlights Forgejo's role as an alternative to other code hosting platforms.