Exposição de Gitea

Development
127
score de exposição
47
sites usam
1
em exploração
7
críticos
Análise Vexday

Com 12 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Gitea apresenta taxa de exploração abaixo da média geral do catálogo, o que indica perfil de risco moderado no contexto atual. Não há vulnerabilidades críticas registradas nem entradas novas nos últimos 90 dias, sugerindo estabilidade recente no volume de descobertas. O tipo de falha mais recorrente é CWE-863 (autorização incorreta), o que aponta para atenção necessária em controles de acesso e verificação de permissões na plataforma. A CVE mais relevante no momento, CVE-2019-1010261, exibe EPSS de 0,0084, valor baixo que reflete probabilidade reduzida de exploração iminente, mas ainda merece acompanhamento em ambientes que não aplicaram as correções disponíveis.

CVEs

111 resultados
CVE-2026-60004CRITICALGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.EPSS 24.0%KEVCVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2019-1010314—Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable reEPSS 0.8%CVE-2019-1010261—Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in bEPSS 0.8%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%CVE-2026-62925MEDIUMGitea Alpine package parsing memory exhaustionEPSS 0.5%CVE-2026-60021MEDIUMGitea GitLab migration denial of serviceEPSS 0.5%CVE-2026-60018MEDIUMGitea OneDev migration denial of serviceEPSS 0.5%CVE-2026-63021MEDIUMGitea Swift package manifest memory exhaustionEPSS 0.5%CVE-2026-73800HIGHGitea reusable workflow secret exposure in pull_request_targetEPSS 0.5%CVE-2026-71184HIGHGitea fork workflow approval bypass through review eventsEPSS 0.5%CVE-2026-73804HIGHGitea API token scope escalation through HTTP signaturesEPSS 0.5%CVE-2026-73539HIGHGitea external renderer argument injection and code executionEPSS 0.5%CVE-2026-60010MEDIUMGitea organization team policy bypass through repository APIEPSS 0.5%CVE-2026-73278CRITICALGitea WebAuthn bypass during OAuth and OIDC sign-inEPSS 0.5%CVE-2026-73814MEDIUMGitea repository ownership escalation by administratorsEPSS 0.5%CVE-2026-73535HIGHGitea second-factor bypass through OpenID identity linkingEPSS 0.4%CVE-2026-63792MEDIUMGitea private reusable workflow disclosure to fork runsEPSS 0.4%CVE-2026-66877HIGHGitea fork workflow approval bypass through concurrency cancellationEPSS 0.4%