Security
فارسی
All products

code.gitea.io/gitea

Go · Package
123 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Gitea allows attackers to add attachments with forbidden file extensionsCVE-2025-68939 · GHSA-263Q-5CV3-XQ9GVersion ranges need review. code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 GoRed Hat High Fix reported
Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer TokensCVE-2026-28744 · GHSA-CC8W-R4QH-3V65Version ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimCVE-2026-23603 · GHSA-X77V-Q46J-393G code.gitea.io/giteagitea.dev Go Low Fix reported
Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118CVE-2026-56443 · GHSA-7P4H-3GXQ-X3H3Version ranges need review. code.gitea.io/giteagitea.dev Go Medium Fix reported
Gitea: Two SSRF findingsCVE-2026-58314 · GHSA-2FCR-JFVC-VGG2 code.gitea.io/giteagitea.dev GoRed Hat High Fix reported
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataCVE-2026-59765 · GHSA-2WM4-VWP6-V7XC code.gitea.io/giteagitea.dev Go Medium Fix reported
Gitea SSH Key Parser Denial of ServiceCVE-2026-56657 · GHSA-4XJF-493Q-98P3Version ranges need review. code.gitea.io/giteagitea.dev Go Medium Fix reported
Gitea draft releases and attachments are exposed without write permissionCVE-2026-27660 · GHSA-X92V-F5GC-R34VVersion ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea forwarded-proto validation allows canonical URL spoofingCVE-2026-27779 · GHSA-V8F2-2GHQ-9WHVVersion ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea pre-receive hook scanner errors allow branch-protection bypassCVE-2026-27780 · GHSA-VHQ7-FWWH-7HJFVersion ranges need review. code.gitea.io/gitea Go Critical Fix reported
Gitea: Remote Code Execution via diffpatch Git Hook InstallationCVE-2026-60004 · GHSA-RCR6-4JQH-J84MVersion ranges need review. code.gitea.io/giteagitea.dev Go Critical Fix reported
Gitea tracked-time deletion is not scoped to the requested issueCVE-2026-25782 · GHSA-QM72-8PRH-G92XVersion ranges need review. code.gitea.io/gitea Go Medium Fix reported
Gitea LFS mirror operations bypass migration HTTP transport protectionsCVE-2026-26292 · GHSA-RC56-RJ3F-XGGFVersion ranges need review. code.gitea.io/gitea Go Critical Fix reported
Gitea Cross-site Scripting VulnerabilityCVE-2024-6886 · GHSA-4H4P-553M-46QHVersion ranges need review. code.gitea.io/gitea Go Critical Fix reported
Gitea primary email ownership bypass allows cross-user email changesCVE-2026-27657 · GHSA-4C8F-3M6H-M56RVersion ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea pull request branch permission checks allow unauthorized updates and rebasesCVE-2026-24690 · GHSA-47RQ-XP99-92MXVersion ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea exposes tracked time entries without repository authorizationCVE-2026-20909 · GHSA-FHQ3-P242-2QPFVersion ranges need review. code.gitea.io/gitea Go Medium Fix reported
Gitea organization permission APIs expose hidden membership and private organization dataCVE-2026-25712 · GHSA-37W2-86G3-H4QHVersion ranges need review. code.gitea.io/gitea Go High Fix reported
Gitea release asset dumps permit path traversal through crafted namesCVE-2026-28705 · GHSA-7JVX-G65V-R899Version ranges need review. code.gitea.io/gitea Go Medium Fix reported
Gitea OAuth2 authorization codes can be reused after expiryCVE-2026-26232 · GHSA-5V69-G2M3-3HQ3Version ranges need review. code.gitea.io/gitea Go Critical Fix reported