Vulnerabilidades em Gitea
210 resultadosAnálise Vexday
Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.
CVE-2026-27783MEDIUMGitea issue-template APIs bypass repository unit authorizationEPSS 0.4%CVE-2026-96580HIGHGitea Actions memory exhaustion through large static matricesEPSS 0.4%CVE-2026-96399HIGHGitea denial of service through external issue tracker patternsEPSS 0.4%CVE-2026-105661MEDIUMGitea panic on the repositories route of individual usersEPSS 0.3%CVE-2026-120263CRITICALGitea OAuth2 account auto-linking takeover through the sign-up formEPSS 0.3%CVE-2026-70406MEDIUMGitea private comparison disclosure with public-only tokensEPSS 0.3%CVE-2026-58437HIGHRepository Visibility Manipulation via Git Push OptionsEPSS 0.3%CVE-2026-116296MEDIUMGitea archived repository release, milestone and label modificationEPSS 0.3%CVE-2026-104626HIGHGitea fork workflow job revival through later approvalEPSS 0.3%CVE-2026-118504MEDIUMGitea issue changes on archived repositories through the APIEPSS 0.3%CVE-2026-95106CRITICALGitea review and execution mismatch through duplicate tree entriesEPSS 0.3%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%CVE-2026-58425MEDIUMOAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)EPSS 0.3%CVE-2026-58431MEDIUMPublic-only API token restriction is not enforced on team API routesEPSS 0.3%CVE-2026-58510MEDIUMGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateEPSS 0.3%CVE-2026-20888MEDIUMGitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)EPSS 0.3%CVE-2026-28740HIGHGitea LFS object reuse bypasses Code-unit authorizationEPSS 0.3%CVE-2026-55986MEDIUMEmail Management API Bypasses ManageCredentials Feature RestrictionsEPSS 0.3%CVE-2026-70407MEDIUMGitea organization listing token scope bypassEPSS 0.3%CVE-2026-58416HIGHFork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)EPSS 0.3%