Vulnerabilidades em Gitea

210 resultados
Análise Vexday

Gitea apresenta perfil de risco moderado com 63 vulnerabilidades catalogadas, sendo 16 críticas (CVSS≥9) e 41 publicadas nos últimos 90 dias, indicando exposição a descobertas recentes. Apesar da ausência de exploração ativa registrada (KEV=0), a fraqueza dominante CWE-284 (controle de acesso inadequado) representa vetor de risco estrutural que demanda revisão de permissões e segmentação. A velocidade de publicação de vulnerabilidades sugere monitoramento contínuo de patches.

CVE-2026-57886MEDIUMCross-repository issue/comment attachment re-linking can expose private attachment contentEPSS 0.3%CVE-2026-95112MEDIUMGitea issue reference parsing CPU exhaustionEPSS 0.3%CVE-2026-97859MEDIUMGitea API disclosure of private user social graph, keys and starsEPSS 0.3%CVE-2026-58418MEDIUMSSRF via HTTP Redirect in Repository MigrationEPSS 0.3%CVE-2026-105964MEDIUMGitea Actions artifact v4 API unbounded request bodyEPSS 0.3%CVE-2026-25779MEDIUMGitea redirect handling permits open redirects through backslash pathsEPSS 0.3%CVE-2026-20904MEDIUMGitea: Broken access control in OpenID visibility toggle enables cross-user visibility changesEPSS 0.3%CVE-2026-54481HIGHInternal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)EPSS 0.3%CVE-2026-71301MEDIUMGitea private pull request title disclosure through markupEPSS 0.3%CVE-2026-58435MEDIUMGitea LFS Deploy-Key Privilege EscalationEPSS 0.3%CVE-2026-73126MEDIUMGitea private workflow badge token scope bypassEPSS 0.3%CVE-2026-23603LOWBlind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimEPSS 0.3%CVE-2026-59763MEDIUMUnbounded Arch package file metadata can cause resource amplification in Gitea package uploadsEPSS 0.3%CVE-2026-59766MEDIUMGitea private repository metadata disclosure after access revocationEPSS 0.3%CVE-2026-119533HIGHGitea private pull request disclosure on project boardsEPSS 0.3%CVE-2026-117685CRITICALGitea public-only package token access to private OCI blobsEPSS 0.3%CVE-2026-116289CRITICALGitea public-only token bypass through Actions runner registrationEPSS 0.3%CVE-2026-118395HIGHGitea public-only token bypass in repository and organization creationEPSS 0.3%CVE-2025-68944MEDIUMGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.EPSS 0.3%CVE-2026-112887MEDIUMGitea Actions task token private repository enumerationEPSS 0.3%