GI
Product
Gitea
On CISA KEVExploited in the wild
131
CVEs
1
On KEV
9.8
Max CVSS
77
New 30D
Severity mix
Critical 17High 35Medium 75Low 3
Watch
Add Gitea to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-29134 | 5.3 | Mar 15 | The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL Affected: before 1.13.6 |
| CVE-2018-1000803 | 5.3 | Oct 8 | Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses Affected: before 1.5.1 |
| CVE-2026-97208 | 4.9 | Oct 6 | Gitea push mirror API bypass of DISABLE_NEW_PUSH policy Affected: through 28.0.0 |
| CVE-2023-3515 | 4.4 | Jul 5 | Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4 Affected: before 1.19.4 |
| CVE-2026-110311 | 4.3 | Oct 18 | Gitea draft release creation disclosing attachment metadata Affected: 1.22.0 through 28.1.0 |
| CVE-2026-109844 | 4.3 | Oct 18 | Gitea watched repositories API disclosure after access revocation Affected: through 1.26.4 |
| CVE-2026-107686 | 4.3 | Oct 18 | Gitea reactions accepted on locked issues and comments Affected: through 28.1.0 |
| CVE-2026-73273 | 4.3 | Oct 14 | Gitea Maven checksum upload quota bypass and memory exhaustion Affected: through 1.27.2 |
| CVE-2026-73130 | 4.3 | Oct 14 | Gitea repository initialization resource exhaustion Affected: through 1.27.2 |
| CVE-2026-73126 | 4.3 | Oct 14 | Gitea private workflow badge token scope bypass Affected: through 1.27.2 |
| CVE-2026-71301 | 4.3 | Oct 14 | Gitea private pull request title disclosure through markup Affected: through 1.27.2 |
| CVE-2026-70407 | 4.3 | Oct 14 | Gitea organization listing token scope bypass Affected: through 1.27.2 |
| CVE-2026-68964 | 4.3 | Oct 14 | Gitea restricted-user SSH and GPG key metadata disclosure Affected: through 1.27.2 |
| CVE-2026-68957 | 4.3 | Oct 14 | Gitea restricted-user issue search disclosure Affected: through 1.27.2 |
| CVE-2026-67577 | 4.3 | Oct 14 | Gitea restricted-user activity and heatmap disclosure Affected: through 1.27.2 |
| CVE-2026-66853 | 4.3 | Oct 14 | Gitea restricted-user organization metadata disclosure Affected: through 1.27.2 |
| CVE-2026-66849 | 4.3 | Oct 14 | Gitea restricted-user package visibility bypass Affected: through 1.27.2 |
| CVE-2026-59766 | 4.3 | Oct 14 | Gitea private repository metadata disclosure after access revocation Affected: 1.25.4 |
| CVE-2026-97626 | 4.3 | Oct 6 | Gitea profile feed disclosure bypassing user visibility Affected: through 28.0.0 |
| CVE-2026-105268 | 4.3 | Oct 6 | Gitea issue attachment API allows changing comment attachments Affected: through 28.0.0 |
| CVE-2026-96589 | 4.3 | Oct 6 | Gitea private repository access retained after rejected transfer Affected: through 1.27.3 |
| CVE-2026-96400 | 4.3 | Oct 6 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS Affected: through 1.27.3 |
| CVE-2026-101029 | 4.3 | Oct 6 | Gitea migration and pull mirror SSRF through multi-answer DNS Affected: through 1.27.3 |
| CVE-2026-20888 | 4.3 | Jan 22 | Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) Affected: before 1.25.4 |
| CVE-2022-46685 | 4.3 | Dec 12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log Affected: before 1.4.5 |