2925 matches found
CVE-2026-58440
A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. Mitigation To mitigate this...
CVE-2026-55987
A flaw was found in Gitea. An attacker can reactivate an administrator-deactivated account by signing in via OAuth2, specifically when using authentication sources that do not utilize refresh tokens. This bypasses intended security controls, allowing unauthorized access to previously deactivated...
CVE-2026-55984
A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...
VulnCheck KEV: CVE-2026-60004
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...
OPENSUSE-SU-2026:21603-1 Security update for gitea-tea
This update for gitea-tea fixes the following issues: Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913: golang.org/x/crypto/ssh/agent client process termination on an unexpected response to a key listing or signing...
CVE-2026-58417
A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure...
Gitea 1.27.0 diffpatch Remote Code Execution
Gitea version 1.27.0 and below contains a remote code execution vulnerability in the diffpatch API. An authenticated attacker with repository write access can submit the same specially crafted patch multiple times to trigger Git's three-way merge fallback and cause an executable post-index-change...
ANT-2026-VN61PHA0 · gitea · IDOR
idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...
FreeBSD : gitea -- Multiple vulnerabilities (2f3568eb-999e-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f3568eb-999e-11f1-a655-3497f65b111b advisory. Gitea reports This release contains fixes for 45 security issues, including privilege...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: gitea-fips, seaweedfs-operator, mattermost, mailpit, bento-fips, mailpit-fips, ollama, fortio-fips, seaweedfs, gitea, ollama-fips, seaweedfs-rocksdb-fips, kubescape-server, nemo, seaweedfs-fips, kitty, kubescape-server-fips, mattermost-fips, rclone, rclone-fips,...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: rclone, kitty, mailpit, bento, pdfcpu, gitea, kubescape, ollama, seaweedfs, mattermost...
GO-2026-6222 vulnerabilities
Vulnerabilities for packages: rclone, kitty, mailpit, bento, pdfcpu, gitea, kubescape, ollama, seaweedfs, mattermost...
Exploit for CVE-2026-20896
CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What...
CVE-2026-57897
creationtimestamp| type| source ---|---|--- 2026-08-14 12:45:14+00:00| seen| https://www.acn.gov.it/portale/w/gitea-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita...
CVE-2026-58511
creationtimestamp| type| source ---|---|--- 2026-08-14 12:45:07+00:00| seen| https://www.acn.gov.it/portale/w/gitea-disponibili-poc-per-lo-sfruttamento-di-nuove-vulnerabilita...
CVE-2026-22555
A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...
GO-2025-4261 vulnerabilities
Vulnerabilities for packages: gitea-fips...
GO-2022-0470 vulnerabilities
Vulnerabilities for packages: gitea-fips, grafana, mattermost-fips, gitea, gitness...