Skip to contentGitea vulnerabilities
Newest
- giteaGitea restricted-user SSH and GPG key metadata disclosureCVE-2026-689644.3 Medium
- giteaGitea restricted-user issue search disclosureCVE-2026-689574.3 Medium
- giteaGitea restricted-user activity and heatmap disclosureCVE-2026-675774.3 Medium
- giteaGitea fork workflow approval bypass through concurrency cancellationCVE-2026-668778.1 High
- giteaGitea required Actions check bypass through skipped workflowsCVE-2026-668746.5 Medium
- giteaGitea restricted-user organization metadata disclosureCVE-2026-668534.3 Medium
- giteaGitea restricted-user package visibility bypassCVE-2026-668494.3 Medium
- giteaGitea private reusable workflow disclosure to fork runsCVE-2026-637925.3 Medium
- giteaGitea Swift package manifest memory exhaustionCVE-2026-630216.5 Medium
- giteaGitea Alpine package parsing memory exhaustionCVE-2026-629256.5 Medium
- giteaGitea GitLab migration denial of serviceCVE-2026-600216.5 Medium
- giteaGitea OneDev migration denial of serviceCVE-2026-600186.5 Medium
- giteaGitea organization team policy bypass through repository APICVE-2026-600106.5 Medium
- giteaGitea Jupyter notebook UI redress through CSS class injectionCVE-2026-600083.5 Low
- giteaGitea Org-mode file disclosure and code executionCVE-2026-59774Public exploitEPSS 28.3%9.8 Critical
- giteaGitea OpenID discovery server-side request forgeryCVE-2026-259465.3 Medium
- giteaGitea profile feed disclosure bypassing user visibilityCVE-2026-976264.3 Medium
- giteaGitea repository media API stored XSSCVE-2026-96594Fix available6.1 Medium
- giteaGitea push-to-create bypass of FORCE_PRIVATE policyCVE-2026-89182Fix available5.4 Medium
- giteaGitea issue attachment API allows changing comment attachmentsCVE-2026-105268Fix available4.3 Medium
- giteaGitea tag delete route deletes releases without release permissionCVE-2026-105267Fix available8.1 High
- giteaGitea migration memory exhaustion from zero page sizeCVE-2026-104633Fix available6.5 Medium
- giteaGitea OAuth2 refresh token grant accepts access tokensCVE-2026-101023Fix available9.1 Critical
- giteaGitea push mirror API bypass of DISABLE_NEW_PUSH policyCVE-2026-97208Fix available4.9 Medium
- giteaGitea push mirror local path check uses the repository ownerCVE-2026-86684Fix available7.1 High
- giteaGitea WebAuthn bypass during OAuth and OIDC sign-inCVE-2026-73278Fix available9.8 Critical
- giteaGitea private repository access retained after rejected transferCVE-2026-96589Fix available4.3 Medium
- giteaGitea Actions memory exhaustion through large static matricesCVE-2026-96580Fix available7.5 High
- giteaGitea installer authentication bypass for existing accountsCVE-2026-96404Fix available8.1 High
- giteaGitea migration SSRF to reserved addresses through ALLOWED_DOMAINSCVE-2026-96400Fix available4.3 Medium
- giteaGitea denial of service through external issue tracker patternsCVE-2026-96399Fix available7.5 High
- giteaGitea issue reference parsing CPU exhaustionCVE-2026-95112Fix available6.5 Medium
- giteaGitea fork workflow approval bypass through maintainer-triggered eventsCVE-2026-94205Fix available9.8 Critical
- giteaGitea deploy key pushes acting as the repository ownerCVE-2026-79960Fix available7.1 High
- giteaGitea repository migration SSRF through DNS rebindingCVE-2026-70357Fix available7.5 High
- giteaGitea SSRF through Git HTTP redirects in mirrors and fetchesCVE-2026-104636Fix available7.5 High
- giteaGitea API team demotion not applied to unit permissionsCVE-2026-1035048.1 High
- giteaGitea review and execution mismatch through duplicate tree entriesCVE-2026-95106Fix available9.1 Critical
- giteaGitea push mirror SSRF and forced writes to internal Git hostsCVE-2026-89430Fix available8.1 High
- giteaGitea trusted workflow cancellation by unapproved fork runsCVE-2026-103670Fix available7.5 High
- giteaGitea container registry stored XSS through blob media typeCVE-2026-103667Fix available5.4 Medium
- giteaGitea migration and pull mirror SSRF through multi-answer DNSCVE-2026-101029Fix available4.3 Medium
- giteaGitea migration SSRF through ALLOWED_DOMAINS address check bypassCVE-2026-101027Fix available7.7 High
- giteaGitea fork workflow job revival through later approvalCVE-2026-104626Fix available8.8 High
- giteaGitea built-in SSH server authentication bypass through key case foldingCVE-2026-103059Fix available9.1 Critical
- giteaGitea fork workflow approval bypass through cancel and rerunCVE-2026-104632Fix available8.8 High
- gitea runnerGitea Runner host isolation bypass through container optionsCVE-2026-73802Public exploitFix available8.8 High
- giteaGitea: Remote Code Execution via diffpatch Git Hook InstallationCVE-2026-60004In KEVPublic exploitFix availableEPSS 24.0%9.8 Critical
- gitea open source git serverGitea runner registration-token GET endpoint performs a write under a read-only token scopeCVE-2026-240596.5 Medium
- gitea open source git serverTwo SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)CVE-2026-585089.1 Critical
- Show moreLoading…