CVE-2026-104627 MEDIUM 5.4 Gitea — The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion withou… 2026-10-18 CVE-2026-105661 MEDIUM 5.3 Gitea — Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organizatio… 2026-10-18 CVE-2026-105964 MEDIUM 6.5 Gitea — The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A… 2026-10-18 CVE-2026-107618 N/A Gitea — `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin pro… 2026-10-18 CVE-2026-107686 MEDIUM 4.3 Gitea — The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues f… 2026-10-18 CVE-2026-109553 HIGH 7.5 Gitea — Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead… 2026-10-18 CVE-2026-109844 MEDIUM 4.3 Gitea — `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checkin… 2026-10-18 CVE-2026-110311 MEDIUM 4.3 Gitea — Creating a draft release through the API returned an `assets` list that was built from a release without an ID… 2026-10-18 CVE-2026-110324 MEDIUM 6.5 Gitea — The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow… 2026-10-18 CVE-2026-110494 MEDIUM 6.3 Gitea — Adding attachments to a release checked the repository and release of an attachment but not whether it was alr… 2026-10-18 CVE-2026-97204 LOW 3.1 Gitea — Deleting a label compared the ID of the repository in the request against the organization ID of organization … 2026-10-18 CVE-2026-97859 MEDIUM 6.5 Gitea — Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, su… 2026-10-18 CVE-2026-25946 MEDIUM 5.3 Gitea — When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests witho… 2026-10-14 CVE-2026-59766 MEDIUM 4.3 Gitea — Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions befor… 2026-10-14 CVE-2026-59774 CRITICAL 9.8 Gitea — Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint witho…● PoC 2026-10-14 CVE-2026-60008 LOW 3.5 Gitea — Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribut… 2026-10-14 CVE-2026-60010 MEDIUM 6.5 Gitea — Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to at… 2026-10-14 CVE-2026-60018 MEDIUM 6.5 Gitea — Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit … 2026-10-14 CVE-2026-60021 MEDIUM 6.5 Gitea — Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the m… 2026-10-14 CVE-2026-62925 MEDIUM 6.5 Gitea — Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .… 2026-10-14 CVE-2026-63021 MEDIUM 6.5 Gitea — Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or the… 2026-10-14 CVE-2026-63792 MEDIUM 5.3 Gitea — Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclud… 2026-10-14 CVE-2026-66849 MEDIUM 4.3 Gitea — Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users … 2026-10-14 CVE-2026-66853 MEDIUM 4.3 Gitea — Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted acco… 2026-10-14 CVE-2026-66874 MEDIUM 6.5 Gitea — For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic ski… 2026-10-14 CVE-2026-66877 HIGH 8.1 Gitea — Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch pat… 2026-10-14 CVE-2026-67577 MEDIUM 4.3 Gitea — Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for rest… 2026-10-14 CVE-2026-68957 MEDIUM 4.3 Gitea — Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating L… 2026-10-14 CVE-2026-68964 MEDIUM 4.3 Gitea — Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equival… 2026-10-14 CVE-2026-70396 MEDIUM 5.4 Gitea — Gitea's organization repository-creation API requires write:organization but omits the write:repository token … 2026-10-14 CVE-2026-70400 MEDIUM 5.4 Gitea — Gitea's repository migration API accepts a public-only token when the request specifies creation of a private … 2026-10-14 CVE-2026-70402 MEDIUM 5.8 Gitea — Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to r… 2026-10-14 CVE-2026-70406 MEDIUM 6.5 Gitea — Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A p… 2026-10-14 CVE-2026-70407 MEDIUM 4.3 Gitea — Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another c… 2026-10-14 CVE-2026-71184 HIGH 8.8 Gitea — Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork… 2026-10-14 CVE-2026-71301 MEDIUM 4.3 Gitea — Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the view… 2026-10-14 CVE-2026-73126 MEDIUM 4.3 Gitea — Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restr… 2026-10-14 CVE-2026-73130 MEDIUM 4.3 Gitea — Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Rep… 2026-10-14 CVE-2026-73135 MEDIUM 5.3 Gitea — Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing en… 2026-10-14 CVE-2026-73273 MEDIUM 4.3 Gitea — Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-… 2026-10-14 CVE-2026-73535 HIGH 8.8 Gitea — Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verificat… 2026-10-14 CVE-2026-73539 HIGH 7.5 Gitea — Gitea substitutes a URL derived from the markup Context field into external renderer command templates without… 2026-10-14 CVE-2026-73800 HIGH 8.8 Gitea — Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow run… 2026-10-14 CVE-2026-73802 HIGH 8.8 Gitea Runner — Gitea Runner passes workflow-controlled container options into Docker job container configuration while privil… 2026-10-14 CVE-2026-73804 HIGH 8.1 Gitea — Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owne…● PoC 2026-10-14 CVE-2026-73814 MEDIUM 6.5 Gitea — Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository coll… 2026-10-14 CVE-2026-78231 MEDIUM 5.3 Gitea — When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST re… 2026-10-14 CVE-2026-78433 MEDIUM 5.9 Gitea — Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 Ja… 2026-10-14 CVE-2026-101023 CRITICAL 9.1 Gitea — Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` g… 2026-10-06 CVE-2026-101027 HIGH 7.7 Gitea — When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without ch… 2026-10-06 CVE-2026-101029 MEDIUM 4.3 Gitea — Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns mult… 2026-10-06 CVE-2026-103059 CRITICAL 9.1 Gitea — When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked u… 2026-10-06 CVE-2026-103504 HIGH 8.1 Gitea — Changing an organization team's permission through the API with only the `permission` field did not rebuild th… 2026-10-06 CVE-2026-103667 MEDIUM 5.4 Gitea — Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in p… 2026-10-06 CVE-2026-103670 HIGH 7.5 Gitea — When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled … 2026-10-06 CVE-2026-104626 HIGH 8.8 Gitea — A user who can open a fork pull request can place workflow content with a shared run-level concurrency group i… 2026-10-06 CVE-2026-104632 HIGH 8.8 Gitea — Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintain… 2026-10-06 CVE-2026-104633 MEDIUM 6.5 Gitea — When migrating a repository from another Gitea instance, Gitea used the page size reported in the source serve… 2026-10-06 CVE-2026-104636 HIGH 7.5 Gitea — Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull requ… 2026-10-06 CVE-2026-105267 HIGH 8.1 Gitea — The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the C… 2026-10-06 CVE-2026-105268 MEDIUM 4.3 Gitea — The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id… 2026-10-06 CVE-2026-70357 HIGH 7.5 Gitea — Gitea validates a repository migration hostname against its network allow and block lists before invoking Git,… 2026-10-06 CVE-2026-73278 CRITICAL 9.8 Gitea — Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the accou… 2026-10-06 CVE-2026-79960 HIGH 7.1 Gitea — When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permiss… 2026-10-06 CVE-2026-86684 HIGH 7.1 Gitea — The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local … 2026-10-06 CVE-2026-89182 MEDIUM 5.4 Gitea — With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook…● PoC 2026-10-06 CVE-2026-89430 HIGH 8.1 Gitea — Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the … 2026-10-06 CVE-2026-94205 CRITICAL 9.8 Gitea — Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the even… 2026-10-06 CVE-2026-95106 CRITICAL 9.1 Gitea — Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks … 2026-10-06 CVE-2026-95112 MEDIUM 6.5 Gitea — When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as … 2026-10-06 CVE-2026-96399 HIGH 7.5 Gitea — A repository's external issue tracker regular expression containing alternating capture groups could produce i… 2026-10-06 CVE-2026-96400 MEDIUM 4.3 Gitea — With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migrat… 2026-10-06 CVE-2026-96404 HIGH 8.1 Gitea — When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL… 2026-10-06 CVE-2026-96580 HIGH 7.5 Gitea — Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when… 2026-10-06 CVE-2026-96589 MEDIUM 4.3 Gitea — When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary rea… 2026-10-06 CVE-2026-96594 MEDIUM 6.1 Gitea — The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are… 2026-10-06 CVE-2026-97208 MEDIUM 4.9 Gitea — The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked on… 2026-10-06 CVE-2026-97626 MEDIUM 4.3 Gitea — Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `A… 2026-10-06