Vulnerabilidades em Gitea
210 resultadosAnálise Vexday
Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.
CVE-2026-70396MEDIUMGitea organization repository creation token scope bypassEPSS 0.4%CVE-2026-68964MEDIUMGitea restricted-user SSH and GPG key metadata disclosureEPSS 0.4%CVE-2026-68957MEDIUMGitea restricted-user issue search disclosureEPSS 0.4%CVE-2026-58314HIGHTwo SSRF findings in Gitea 1.26.2EPSS 0.4%CVE-2026-104633MEDIUMGitea migration memory exhaustion from zero page sizeEPSS 0.4%CVE-2026-58421HIGHUnauthenticated ReDoS via CODEOWNERS pattern matching allows denial of serviceEPSS 0.4%CVE-2026-25714MEDIUMGitea user organization API bypasses public-only token filteringEPSS 0.4%CVE-2026-58423HIGHLFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositoriesEPSS 0.4%CVE-2026-103059CRITICALGitea built-in SSH server authentication bypass through key case foldingEPSS 0.4%CVE-2026-20909MEDIUMGitea tracked-time list endpoint has insufficient permission checksEPSS 0.4%CVE-2026-25782MEDIUMGitea tracked-time deletion can target entries from another issueEPSS 0.4%CVE-2026-73273MEDIUMGitea Maven checksum upload quota bypass and memory exhaustionEPSS 0.4%CVE-2026-34966HIGHGitea prior to 1.27.0 SSRF via Migration URI Fetch BypassEPSS 0.4%CVE-2026-104632HIGHGitea fork workflow approval bypass through cancel and rerunEPSS 0.4%CVE-2026-58511LOWWebhook Authorization Header Returned in Plaintext via APIEPSS 0.4%CVE-2026-22555HIGHGitea organization forks can expose organization secrets without create permissionEPSS 0.4%CVE-2025-69413MEDIUMIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.EPSS 0.4%CVE-2026-58507MEDIUMPrivate Repository Existence Disclosure via go-get Meta EndpointEPSS 0.4%CVE-2025-68938MEDIUMGitea before 1.25.2 mishandles authorization for deletion of releases.EPSS 0.4%CVE-2026-70400MEDIUMGitea private migration creation with public-only tokensEPSS 0.4%