Gitea vulnerabilities

Products

• Gitea 152
• Open Source Git Server 97

Newest

• gitea Gitea limited-visibility profile disclosure with public-only tokens CVE-2026-119627 4.3 MediumNovember 1, 2026
• gitea Gitea user and organization feed token scope bypass CVE-2026-119625 4.3 MediumNovember 1, 2026
• gitea Gitea private pull request disclosure on project boards CVE-2026-119533 7.5 HighNovember 1, 2026
• gitea Gitea public-only token bypass on bulk organization repository deletion CVE-2026-119441 7.5 HighNovember 1, 2026
• gitea Gitea issue changes on archived repositories through the API CVE-2026-118504 6.5 MediumNovember 1, 2026
• gitea Gitea public-only token bypass in repository and organization creation CVE-2026-118395 7.5 HighNovember 1, 2026
• gitea Gitea OAuth2 userinfo private group disclosure to public-only tokens CVE-2026-118394 4.3 MediumNovember 1, 2026
• gitea Gitea public-only package token access to private OCI blobs CVE-2026-117685 9.1 CriticalNovember 1, 2026
• gitea Gitea Helm chart upload decompression denial of service CVE-2026-117677 No scoreNovember 1, 2026
• gitea Gitea private issue disclosure through issue dependency timeline events CVE-2026-117649 3.5 LowNovember 1, 2026
• gitea Gitea private repository listing to public-only tokens on profiles CVE-2026-117646 4.3 MediumNovember 1, 2026
• gitea Gitea admin API public-only token scope bypass CVE-2026-117635 6.5 MediumNovember 1, 2026
• gitea Gitea Actions job token spoofing of instance-signed commits CVE-2026-116474 6.5 MediumNovember 1, 2026
• gitea Gitea archived repository release, milestone and label modification CVE-2026-116296 Public exploit 6.5 MediumNovember 1, 2026
• gitea Gitea public-only token bypass through Actions runner registration CVE-2026-116289 9.1 CriticalNovember 1, 2026
• gitea Gitea contribution heatmap private activity disclosure to public-only tokens CVE-2026-114199 5.3 MediumNovember 1, 2026
• gitea Gitea stored XSS through legacy Actions artifact Content-Encoding CVE-2026-113429 5.4 MediumNovember 1, 2026
• gitea Gitea Actions task token private repository enumeration CVE-2026-112887 4.3 MediumNovember 1, 2026
• gitea Gitea OAuth2 account auto-linking takeover through the sign-up form CVE-2026-120263 9.8 CriticalNovember 1, 2026
• gitea Gitea Actions fork workflow trust through pull request review commit CVE-2026-118386 6.5 MediumNovember 1, 2026
• gitea Gitea API disclosure of private user social graph, keys and stars CVE-2026-97859 Public exploit 6.5 MediumOctober 18, 2026
• gitea Gitea label deletion across repository and organization IDs CVE-2026-97204 3.1 LowOctober 18, 2026
• gitea Gitea release attachment re-linking of issue attachments CVE-2026-110494 6.3 MediumOctober 18, 2026
• gitea Gitea private profile information disclosure through POST request CVE-2026-110324 6.5 MediumOctober 18, 2026
• gitea Gitea draft release creation disclosing attachment metadata CVE-2026-110311 Public exploit 4.3 MediumOctober 18, 2026
• gitea Gitea watched repositories API disclosure after access revocation CVE-2026-109844 4.3 MediumOctober 18, 2026
• gitea Gitea reactions accepted on locked issues and comments CVE-2026-107686 4.3 MediumOctober 18, 2026
• gitea Gitea cross-site request forgery on repository topics CVE-2026-107618 8.1 HighOctober 18, 2026
• gitea Gitea Actions artifact v4 API unbounded request body CVE-2026-105964 6.5 MediumOctober 18, 2026
• gitea Gitea panic on the repositories route of individual users CVE-2026-105661 5.3 MediumOctober 18, 2026
• gitea Gitea SSH certificate principal impersonation of other users CVE-2026-109553 7.5 HighOctober 18, 2026
• gitea Gitea OpenID account linking without session binding CVE-2026-104627 5.4 MediumOctober 18, 2026
• gitea Gitea private attachment disclosure through repository mismatch CVE-2026-78433 5.9 MediumOctober 14, 2026
• gitea Gitea blind SSRF through OpenID assertion verification CVE-2026-78231 5.3 MediumOctober 14, 2026
• gitea Gitea repository ownership escalation by administrators CVE-2026-73814 6.5 MediumOctober 14, 2026
• gitea Gitea API token scope escalation through HTTP signatures CVE-2026-73804 8.1 HighOctober 14, 2026
• gitea Gitea reusable workflow secret exposure in pull_request_target CVE-2026-73800 8.8 HighOctober 14, 2026
• gitea Gitea external renderer argument injection and code execution CVE-2026-73539 7.5 HighOctober 14, 2026
• gitea Gitea second-factor bypass through OpenID identity linking CVE-2026-73535 8.8 HighOctober 14, 2026
• gitea Gitea Maven checksum upload quota bypass and memory exhaustion CVE-2026-73273 4.3 MediumOctober 14, 2026
• gitea Gitea hidden-owner repository listing disclosure CVE-2026-73135 5.3 MediumOctober 14, 2026
• gitea Gitea repository initialization resource exhaustion CVE-2026-73130 4.3 MediumOctober 14, 2026
• gitea Gitea private workflow badge token scope bypass CVE-2026-73126 4.3 MediumOctober 14, 2026
• gitea Gitea private pull request title disclosure through markup CVE-2026-71301 4.3 MediumOctober 14, 2026
• gitea Gitea fork workflow approval bypass through review events CVE-2026-71184 8.8 HighOctober 14, 2026
• gitea Gitea organization listing token scope bypass CVE-2026-70407 4.3 MediumOctober 14, 2026
• gitea Gitea private comparison disclosure with public-only tokens CVE-2026-70406 6.5 MediumOctober 14, 2026
• gitea Gitea local code execution through writable Git hooks CVE-2026-70402 5.8 MediumOctober 14, 2026
• gitea Gitea private migration creation with public-only tokens CVE-2026-70400 5.4 MediumOctober 14, 2026
• gitea Gitea organization repository creation token scope bypass CVE-2026-70396 5.4 MediumOctober 14, 2026
• Show olderLoading…