That's quite annoying - "security fixes" - but no information if your installation is affected or not? (Eg: in a module that's disabled)?

Makes work harder for sys admins - little difference for black hats.

It's still a (<LLM> look at diffs in latest gitea release - find the patched security issues and write poc exploit for cve assessment) I guess?