Log in Start free

Gitea

Products

ProductCVEsExploitedLatest
Gitea1091Nov 1, 2026
Gitea Open Source Git Server97–Aug 13, 2026
act_runner1–Jun 28, 2026
Gitea Runner1–Oct 14, 2026

Exploited and recent CVEs

  • CVE-2026-60004 Critical 9.8 Exploited Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. 24.0%
  • CVE-2026-119627 Unrated Gitea limited-visibility profile disclosure with public-only tokens 0.2%
  • CVE-2026-119625 Unrated Gitea user and organization feed token scope bypass 0.2%
  • CVE-2026-119533 Unrated Gitea private pull request disclosure on project boards 0.1%
  • CVE-2026-119441 Unrated Gitea public-only token bypass on bulk organization repository deletion 0.1%
  • CVE-2026-118504 Unrated Gitea issue changes on archived repositories through the API 0.2%
  • CVE-2026-118395 Unrated Gitea public-only token bypass in repository and organization creation 0.2%
  • CVE-2026-118394 Unrated Gitea OAuth2 userinfo private group disclosure to public-only tokens 0.1%
  • CVE-2026-117685 Unrated Gitea public-only package token access to private OCI blobs 0.1%
  • CVE-2026-117677 Unrated Gitea Helm chart upload decompression denial of service 0.2%
  • CVE-2026-117649 Unrated Gitea private issue disclosure through issue dependency timeline events 0.2%
  • CVE-2026-117646 Unrated Gitea private repository listing to public-only tokens on profiles 0.2%
  • CVE-2026-117635 Unrated Gitea admin API public-only token scope bypass 0.1%
  • CVE-2026-116474 Unrated Gitea Actions job token spoofing of instance-signed commits 0.1%
  • CVE-2026-116296 Unrated Gitea archived repository release, milestone and label modification 0.3%
  • CVE-2026-116289 Unrated Gitea public-only token bypass through Actions runner registration 0.1%
  • CVE-2026-114199 Unrated Gitea contribution heatmap private activity disclosure to public-only tokens 0.2%
  • CVE-2026-113429 Unrated Gitea stored XSS through legacy Actions artifact Content-Encoding 0.2%
  • CVE-2026-112887 Unrated Gitea Actions task token private repository enumeration 0.2%
  • CVE-2026-120263 Unrated Gitea OAuth2 account auto-linking takeover through the sign-up form 0.2%
  • CVE-2026-118386 Unrated Gitea Actions fork workflow trust through pull request review commit 0.1%
  • CVE-2026-97859 Medium 6.5 Gitea API disclosure of private user social graph, keys and stars 0.3%
  • CVE-2026-97204 Low 3.1 Gitea label deletion across repository and organization IDs 0.2%
  • CVE-2026-110494 Medium 6.3 Gitea release attachment re-linking of issue attachments 0.2%
  • CVE-2026-110324 Medium 6.5 Gitea private profile information disclosure through POST request 0.3%
  • CVE-2026-110311 Medium 4.3 Gitea draft release creation disclosing attachment metadata 0.2%
  • CVE-2026-109844 Medium 4.3 Gitea watched repositories API disclosure after access revocation 0.2%
  • CVE-2026-107686 Medium 4.3 Gitea reactions accepted on locked issues and comments 0.2%
  • CVE-2026-107618 High 8.1 Gitea cross-site request forgery on repository topics 0.2%
  • CVE-2026-105964 Medium 6.5 Gitea Actions artifact v4 API unbounded request body 0.3%