Exposure of Gitea

Development
127
exposure score
47
sites use
1
exploited
7
critical

CVEs

111 results
CVE-2026-73135MEDIUMGitea hidden-owner repository listing disclosureEPSS 0.4%CVE-2025-68945MEDIUMIn Gitea before 1.21.2, an anonymous user can visit a private user's project.EPSS 0.4%CVE-2025-68943MEDIUMGitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.EPSS 0.4%CVE-2026-101023CRITICALGitea OAuth2 refresh token grant accepts access tokensEPSS 0.4%CVE-2026-96399HIGHGitea denial of service through external issue tracker patternsEPSS 0.4%CVE-2026-96580HIGHGitea Actions memory exhaustion through large static matricesEPSS 0.4%CVE-2026-105661MEDIUMGitea panic on the repositories route of individual usersEPSS 0.3%CVE-2026-70406MEDIUMGitea private comparison disclosure with public-only tokensEPSS 0.3%CVE-2026-104626HIGHGitea fork workflow job revival through later approvalEPSS 0.3%CVE-2026-95106CRITICALGitea review and execution mismatch through duplicate tree entriesEPSS 0.3%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%CVE-2026-70407MEDIUMGitea organization listing token scope bypassEPSS 0.3%CVE-2026-95112MEDIUMGitea issue reference parsing CPU exhaustionEPSS 0.3%CVE-2026-97859MEDIUMGitea API disclosure of private user social graph, keys and starsEPSS 0.3%CVE-2026-105964MEDIUMGitea Actions artifact v4 API unbounded request bodyEPSS 0.3%CVE-2026-73126MEDIUMGitea private workflow badge token scope bypassEPSS 0.3%CVE-2026-71301MEDIUMGitea private pull request title disclosure through markupEPSS 0.3%CVE-2026-59766MEDIUMGitea private repository metadata disclosure after access revocationEPSS 0.3%CVE-2025-68944MEDIUMGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.EPSS 0.3%CVE-2025-68940LOWIn Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.EPSS 0.3%