Vulnerabilidades en Gitea
210 resultadosCVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%CVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2026-60004CRITICALGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.EPSS 24.0%KEVCVE-2026-20896CRITICALGitea Docker image trusts spoofable reverse-proxy headers by defaultEPSS 2.8%CVE-2026-27771HIGHGitea Composer package source links use insufficient permission checksEPSS 1.4%CVE-2026-27775HIGHGitea pre-receive hook permission cache allows full repository write accessEPSS 0.9%CVE-2019-1010314—Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable reEPSS 0.8%CVE-2019-1010261—Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in bEPSS 0.8%CVE-2026-56654CRITICALPrivilege Escalation via Access Token Scope Escalation in APIEPSS 0.8%CVE-2026-26292CRITICALGitea LFS mirror synchronization bypasses migration HTTP transport restrictionsEPSS 0.7%CVE-2026-27780CRITICALGitea pre-receive hook can miss branch-protection checks after scanner errorsEPSS 0.6%CVE-2026-26307HIGHGitea git grep search lacks a timeoutEPSS 0.6%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-25038HIGHGitea private organization labels are visible to unauthorized usersEPSS 0.6%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.6%CVE-2026-20706CRITICALGitea repository archive downloads bypass token scope checksEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%CVE-2026-27779HIGHGitea forwarded-proto handling allows public URL spoofingEPSS 0.6%CVE-2026-58443CRITICALPublic-only repository tokens can update private PR head branchesEPSS 0.6%CVE-2026-25718CRITICALGitea template repository generation mishandles symlinked pathsEPSS 0.6%