Gitea vulnerabilities
210 CVEs and advisories name Gitea as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-62925Gitea Alpine package parsing memory exhaustion
- CVE-2026-60021Gitea GitLab migration denial of service
- CVE-2026-60018Gitea OneDev migration denial of service
- CVE-2026-60010Gitea organization team policy bypass through repository API
- CVE-2026-60008Gitea Jupyter notebook UI redress through CSS class injection
- CVE-2026-59774Gitea Org-mode file disclosure and code execution
- CVE-2026-59766Gitea private repository metadata disclosure after access revocation
- CVE-2026-25946Gitea OpenID discovery server-side request forgery
- CVE-2026-97626Gitea profile feed disclosure bypassing user visibility
- CVE-2026-96594Gitea repository media API stored XSS
- CVE-2026-89182Gitea push-to-create bypass of FORCE_PRIVATE policy
- CVE-2026-105268Gitea issue attachment API allows changing comment attachments
- CVE-2026-105267Gitea tag delete route deletes releases without release permission
- CVE-2026-104633Gitea migration memory exhaustion from zero page size
- CVE-2026-101023Gitea OAuth2 refresh token grant accepts access tokens
- CVE-2026-97208Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
- CVE-2026-86684Gitea push mirror local path check uses the repository owner
- CVE-2026-73278Gitea WebAuthn bypass during OAuth and OIDC sign-in
- CVE-2026-96589Gitea private repository access retained after rejected transfer
- CVE-2026-96580Gitea Actions memory exhaustion through large static matrices
- CVE-2026-96404Gitea installer authentication bypass for existing accounts
- CVE-2026-96400Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
- CVE-2026-96399Gitea denial of service through external issue tracker patterns
- CVE-2026-95112Gitea issue reference parsing CPU exhaustion
- CVE-2026-94205Gitea fork workflow approval bypass through maintainer-triggered events
- CVE-2026-79960Gitea deploy key pushes acting as the repository owner
- CVE-2026-70357Gitea repository migration SSRF through DNS rebinding
- CVE-2026-104636Gitea SSRF through Git HTTP redirects in mirrors and fetches
- CVE-2026-103504Gitea API team demotion not applied to unit permissions
- CVE-2026-95106Gitea review and execution mismatch through duplicate tree entries