Exposure of Gitea

Development
127
exposure score
47
sites use
1
exploited
7
critical

CVEs

111 results
CVE-2026-25946MEDIUMGitea OpenID discovery server-side request forgeryEPSS 0.4%CVE-2026-70396MEDIUMGitea organization repository creation token scope bypassEPSS 0.4%CVE-2026-68957MEDIUMGitea restricted-user issue search disclosureEPSS 0.4%CVE-2026-68964MEDIUMGitea restricted-user SSH and GPG key metadata disclosureEPSS 0.4%CVE-2026-104633MEDIUMGitea migration memory exhaustion from zero page sizeEPSS 0.4%CVE-2026-103059CRITICALGitea built-in SSH server authentication bypass through key case foldingEPSS 0.4%CVE-2026-34966HIGHGitea prior to 1.27.0 SSRF via Migration URI Fetch BypassEPSS 0.4%CVE-2026-73273MEDIUMGitea Maven checksum upload quota bypass and memory exhaustionEPSS 0.4%CVE-2026-104632HIGHGitea fork workflow approval bypass through cancel and rerunEPSS 0.4%CVE-2025-69413MEDIUMIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.EPSS 0.4%CVE-2026-70400MEDIUMGitea private migration creation with public-only tokensEPSS 0.4%CVE-2025-68938MEDIUMGitea before 1.25.2 mishandles authorization for deletion of releases.EPSS 0.4%CVE-2026-105267HIGHGitea tag delete route deletes releases without release permissionEPSS 0.4%CVE-2026-66853MEDIUMGitea restricted-user organization metadata disclosureEPSS 0.4%CVE-2026-67577MEDIUMGitea restricted-user activity and heatmap disclosureEPSS 0.4%CVE-2026-66849MEDIUMGitea restricted-user package visibility bypassEPSS 0.4%CVE-2026-60008LOWGitea Jupyter notebook UI redress through CSS class injectionEPSS 0.4%CVE-2026-78433MEDIUMGitea private attachment disclosure through repository mismatchEPSS 0.4%CVE-2026-70357HIGHGitea repository migration SSRF through DNS rebindingEPSS 0.4%CVE-2026-73130MEDIUMGitea repository initialization resource exhaustionEPSS 0.4%