Exposição de Gitea

Development
127
score de exposição
47
sites usam
1
em exploração
7
críticos
Análise Vexday

Com 12 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Gitea apresenta taxa de exploração abaixo da média geral do catálogo, o que indica perfil de risco moderado no contexto atual. Não há vulnerabilidades críticas registradas nem entradas novas nos últimos 90 dias, sugerindo estabilidade recente no volume de descobertas. O tipo de falha mais recorrente é CWE-863 (autorização incorreta), o que aponta para atenção necessária em controles de acesso e verificação de permissões na plataforma. A CVE mais relevante no momento, CVE-2019-1010261, exibe EPSS de 0,0084, valor baixo que reflete probabilidade reduzida de exploração iminente, mas ainda merece acompanhamento em ambientes que não aplicaram as correções disponíveis.

CVEs

111 resultados
CVE-2026-73135MEDIUMGitea hidden-owner repository listing disclosureEPSS 0.4%CVE-2025-68945MEDIUMIn Gitea before 1.21.2, an anonymous user can visit a private user's project.EPSS 0.4%CVE-2025-68943MEDIUMGitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.EPSS 0.4%CVE-2026-101023CRITICALGitea OAuth2 refresh token grant accepts access tokensEPSS 0.4%CVE-2026-96399HIGHGitea denial of service through external issue tracker patternsEPSS 0.4%CVE-2026-96580HIGHGitea Actions memory exhaustion through large static matricesEPSS 0.4%CVE-2026-105661MEDIUMGitea panic on the repositories route of individual usersEPSS 0.3%CVE-2026-70406MEDIUMGitea private comparison disclosure with public-only tokensEPSS 0.3%CVE-2026-104626HIGHGitea fork workflow job revival through later approvalEPSS 0.3%CVE-2026-95106CRITICALGitea review and execution mismatch through duplicate tree entriesEPSS 0.3%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%CVE-2026-70407MEDIUMGitea organization listing token scope bypassEPSS 0.3%CVE-2026-95112MEDIUMGitea issue reference parsing CPU exhaustionEPSS 0.3%CVE-2026-97859MEDIUMGitea API disclosure of private user social graph, keys and starsEPSS 0.3%CVE-2026-105964MEDIUMGitea Actions artifact v4 API unbounded request bodyEPSS 0.3%CVE-2026-73126MEDIUMGitea private workflow badge token scope bypassEPSS 0.3%CVE-2026-71301MEDIUMGitea private pull request title disclosure through markupEPSS 0.3%CVE-2026-59766MEDIUMGitea private repository metadata disclosure after access revocationEPSS 0.3%CVE-2025-68944MEDIUMGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.EPSS 0.3%CVE-2025-68940LOWIn Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.EPSS 0.3%