Vulnerabilidades en Gitea

112 resultados
Análisis Vexday

Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.

CVE-2026-58442MEDIUMRepository migration SSRF via multi-answer DNS allow-list bypassEPSS 0.2%CVE-2026-58511LOWWebhook Authorization Header Returned in Plaintext via APIEPSS 0.2%CVE-2026-58444MEDIUMPersonal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsEPSS 0.2%CVE-2026-59763MEDIUMUnbounded Arch package file metadata can cause resource amplification in Gitea package uploadsEPSS 0.2%CVE-2026-56657MEDIUMGitea SSH Key Parser Denial of ServiceEPSS 0.2%CVE-2026-58445LOWCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIEPSS 0.2%CVE-2026-58437HIGHRepository Visibility Manipulation via Git Push OptionsEPSS 0.2%CVE-2026-58510MEDIUMGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateEPSS 0.2%CVE-2026-58431MEDIUMPublic-only API token restriction is not enforced on team API routesEPSS 0.2%CVE-2026-58435MEDIUMGitea LFS Deploy-Key Privilege EscalationEPSS 0.2%CVE-2026-56755MEDIUMDenial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadEPSS 0.2%CVE-2026-58441MEDIUMSSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLEPSS 0.2%