Vulnerabilities in Gitea
210 resultsCVE-2026-118386MEDIUMGitea Actions fork workflow trust through pull request review commitEPSS 0.2%CVE-2026-107686MEDIUMGitea reactions accepted on locked issues and commentsEPSS 0.2%CVE-2026-101027HIGHGitea migration SSRF through ALLOWED_DOMAINS address check bypassEPSS 0.2%CVE-2026-58426CRITICALGitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state writeEPSS 0.2%CVE-2026-96594MEDIUMGitea repository media API stored XSSEPSS 0.2%CVE-2026-110311MEDIUMGitea draft release creation disclosing attachment metadataEPSS 0.2%CVE-2026-103670HIGHGitea trusted workflow cancellation by unapproved fork runsEPSS 0.2%CVE-2026-79960HIGHGitea deploy key pushes acting as the repository ownerEPSS 0.2%CVE-2026-117677—Gitea Helm chart upload decompression denial of serviceEPSS 0.2%CVE-2026-117646MEDIUMGitea private repository listing to public-only tokens on profilesEPSS 0.2%CVE-2026-97626MEDIUMGitea profile feed disclosure bypassing user visibilityEPSS 0.2%CVE-2026-118394MEDIUMGitea OAuth2 userinfo private group disclosure to public-only tokensEPSS 0.2%CVE-2026-109844MEDIUMGitea watched repositories API disclosure after access revocationEPSS 0.2%CVE-2026-96400MEDIUMGitea migration SSRF to reserved addresses through ALLOWED_DOMAINSEPSS 0.2%CVE-2026-110494MEDIUMGitea release attachment re-linking of issue attachmentsEPSS 0.2%CVE-2026-89182MEDIUMGitea push-to-create bypass of FORCE_PRIVATE policyEPSS 0.2%CVE-2026-105268MEDIUMGitea issue attachment API allows changing comment attachmentsEPSS 0.2%CVE-2026-103667MEDIUMGitea container registry stored XSS through blob media typeEPSS 0.2%CVE-2026-70402MEDIUMGitea local code execution through writable Git hooksEPSS 0.2%CVE-2026-97204LOWGitea label deletion across repository and organization IDsEPSS 0.2%