Skip to contentGitea vulnerabilities
Newest
- gitea open source git serverUnauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceCVE-2026-58421Fix available7.5 High
- gitea open source git serverNotification API leaks private issue metadata after access revocationCVE-2026-58419Fix available7.5 High
- gitea open source git serverSSRF via HTTP Redirect in Repository MigrationCVE-2026-58418Fix available6.5 Medium
- gitea open source git serverGitea LFS object reuse bypasses Code-unit authorizationCVE-2026-28740Fix available7.1 High
- gitea open source git serverGitea repository dumps write release assets using unsafe path namesCVE-2026-28705Fix available5.3 Medium
- gitea open source git serverGitea pre-receive hook can miss branch-protection checks after scanner errorsCVE-2026-27780Fix available9.8 Critical
- gitea open source git serverGitea forwarded-proto handling allows public URL spoofingCVE-2026-27779Fix available7.5 High
- gitea open source git serverGitea pre-receive hook permission cache allows full repository write accessCVE-2026-27775Fix available8.8 High
- gitea open source git serverGitea Composer package source links use insufficient permission checksCVE-2026-27771Public exploitFix available8.2 High
- gitea open source git serverGitea repository feeds bypass API token scope enforcementCVE-2026-27761Fix available4.3 Medium
- gitea open source git serverGitea draft releases use insufficient permission checksCVE-2026-27660Fix available7.5 High
- gitea open source git serverGitea email settings allow changing another user's primary email addressCVE-2026-27657Fix available7.5 High
- gitea open source git serverGitea git grep search lacks a timeoutCVE-2026-26307Fix available7.5 High
- gitea open source git serverGitea LFS mirror synchronization bypasses migration HTTP transport restrictionsCVE-2026-26292Fix available9.8 Critical
- gitea open source git serverGitea OAuth2 PKCE S256 challenges are not enforced during token exchangeCVE-2026-26247Fix available9.1 Critical
- gitea open source git serverGitea OAuth2 authorization codes lack expiry and reuse enforcementCVE-2026-26232Fix available9.1 Critical
- gitea open source git serverGitea tracked-time deletion can target entries from another issueCVE-2026-25782Fix available5.3 Medium
- gitea open source git serverGitea template repository generation mishandles symlinked pathsCVE-2026-25718Fix available9.1 Critical
- gitea open source git serverGitea organization permission APIs expose private visibility informationCVE-2026-25712Fix available7.5 High
- gitea open source git serverGitea private organization labels are visible to unauthorized usersCVE-2026-25038Fix available7.5 High
- gitea open source git serverGitea pull-request branch updates use insufficient permission checksCVE-2026-24690Fix available7.5 High
- gitea open source git serverGitea fork synchronization can expose private parent repository dataCVE-2026-24451Fix available7.5 High
- gitea open source git serverGitea webhook and migration allow-list filtering permits SSRFCVE-2026-22874Public exploitFix available9.6 Critical
- gitea open source git serverGitea repository creation accepts invalid field valuesCVE-2026-22547Fix available9.1 Critical
- gitea open source git serverGitea tracked-time list endpoint has insufficient permission checksCVE-2026-20909Fix available5.3 Medium
- gitea open source git serverGitea Docker image trusts spoofable reverse-proxy headers by defaultCVE-2026-20896Public exploitFix available9.8 Critical
- gitea open source git serverGitea TOTP single-use enforcement defect allows OTP replayCVE-2026-20779Fix available7.1 High
- gitea act runnerGitea act_runner - Container Hardening Bypass via Workflow Container OptionsCVE-2026-580539.4 Critical
- gitea open source git serverGitea redirect handling permits open redirects through backslash pathsCVE-2026-25779Fix available6.1 Medium
- gitea open source git serverGitea 3D file viewer allows stored XSS through glTF extensionsRequiredCVE-2026-28737Fix available8.7 High
- gitea open source git serverPublic-only tokens bypass private-resource restrictions on `/api/v1/user` self routesCVE-2026-24791Fix available8.1 High
- gitea open source git serverGitea organization forks can expose organization secrets without create permissionCVE-2026-22555Fix available8.1 High
- gitea open source git serverGitea repository archive downloads bypass token scope checksCVE-2026-20706Fix available9.1 Critical
- gitea open source git serverGitea issue-template APIs bypass repository unit authorizationCVE-2026-27783Fix available4.3 Medium
- gitea open source git serverGitea user organization API bypasses public-only token filteringCVE-2026-25714Fix available4.3 Medium
- gitea open source git serverGitea maintainer-edit permissions allow unauthorized commits to readable repositoriesCVE-2026-26231Fix available8.5 High
- gitea open source git serverGitea Basic Auth bypasses OAuth2 access token scopesCVE-2026-28699Public exploitFix available8.1 High
- gitea open source git serverGitea Git smart HTTP bypasses repository token scopes for bearer tokensCVE-2026-28744Fix available8.1 High
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureCVE-2026-20912Fix available9.1 Critical
- gitea, gitea open source git server +1 moreGitea: Broken access control in OpenID visibility toggle enables cross-user visibility changesCVE-2026-20904Fix available6.5 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)CVE-2026-20897Fix available9.1 Critical
- gitea, gitea open source git server +1 moreGitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)CVE-2026-20888Fix available4.3 Medium
- gitea, gitea open source git server +1 moreGitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information DisclosureCVE-2026-20883Fix available6.5 Medium
- gitea, gitea open source git server +1 moreNotification API Leaks Private Repository Issue Titles After Collaborator Permission RevocationCVE-2026-20800Fix available6.5 Medium
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)CVE-2026-20750Fix available9.1 Critical
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership CheckCVE-2026-20736Fix available7.5 High
- gitea, gitea open source git server +1 moreGitea Release Email Notifications Leak Private Repository Release Details After Access RevocationCVE-2026-0798Fix available3.5 Low
- giteaGitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username existsCVE-2025-69413Fix available5.3 Medium
- giteaGitea vulnerable to Cross-site ScriptingCVE-2025-68946Fix available5.4 Medium
- giteaGitea: anonymous user can visit private user's projectCVE-2025-68945Fix available5.8 Medium
- Show moreLoading…