CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-01
Gitea Actions Artifact Upload Stored Cross-Site Scripting (XSS) and CSP Bypass Vulnerability (CVE-2026-113429)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
[Impact] Attackers with Actions execution privileges can upload malicious HTML artifacts to execute arbitrary scripts in the victim's browser session, potentially leading to full instance takeover if an administrator triggers the payload
[Mitigation] Immediately upgrade Gitea to version v28.3.0 or later