Gitea security advisory (AV26-845) - Update 1

Serial Number: AV26-845Date: August 25, 2026Updated: October 20, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior to 1.27.1 Update 1 Open-source reporting indicates that CVE-2026-20896 is being exploited in the wild. On August 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Remote Code Execution via diffpatch Git Hook Installation Gitea 1.27.1 is released Gitea 1.27.2 is released CISA KEV: CVE-2026-60004