Vulnerabilidades en Gitea
64 resultadosAnálisis Vexday
Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.
CVE-2026-27771HIGHGitea Composer package source links use insufficient permission checksEPSS 43.1%CVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2026-20896CRITICALGitea Docker image trusts spoofable reverse-proxy headers by defaultEPSS 31.8%CVE-2019-1010314—Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable reEPSS 0.8%CVE-2019-1010261—Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in bEPSS 0.8%CVE-2026-27775HIGHGitea pre-receive hook permission cache allows full repository write accessEPSS 0.6%CVE-2026-28699HIGHGitea Basic Auth bypasses OAuth2 access token scopesEPSS 0.6%CVE-2026-22874CRITICALGitea webhook and migration allow-list filtering permits SSRFEPSS 0.6%CVE-2026-20706CRITICALGitea repository archive downloads bypass token scope checksEPSS 0.5%CVE-2026-26292CRITICALGitea LFS mirror synchronization bypasses migration HTTP transport restrictionsEPSS 0.5%CVE-2026-27780CRITICALGitea pre-receive hook can miss branch-protection checks after scanner errorsEPSS 0.5%CVE-2026-26307HIGHGitea git grep search lacks a timeoutEPSS 0.5%CVE-2026-27779HIGHGitea forwarded-proto handling allows public URL spoofingEPSS 0.4%CVE-2026-25718CRITICALGitea template repository generation mishandles symlinked pathsEPSS 0.4%CVE-2026-25038HIGHGitea private organization labels are visible to unauthorized usersEPSS 0.4%CVE-2026-20912CRITICALGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureEPSS 0.4%CVE-2026-20897CRITICALGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)EPSS 0.4%CVE-2026-20779HIGHGitea TOTP single-use enforcement defect allows OTP replayEPSS 0.4%CVE-2026-20750CRITICALGitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)EPSS 0.4%CVE-2026-20736HIGHGitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership CheckEPSS 0.4%