CVE Tools
Track your stack

Gitea

151 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Gitea, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.

Gitea CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Gitea CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-129
2026-0110
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-082
2026-090
2026-1077
2026-1120

Severity

How the 151 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2013%
  • High4027%
  • Medium8456%
  • Low64%

Latest CVEs

The 15 most recently published vulnerabilities affecting Gitea.

  1. CVE-2026-119627Gitea limited-visibility profile disclosure with public-only tokens4.3
  2. CVE-2026-119625Gitea user and organization feed token scope bypass4.3
  3. CVE-2026-119533Gitea private pull request disclosure on project boards7.5
  4. CVE-2026-119441Gitea public-only token bypass on bulk organization repository deletion7.5
  5. CVE-2026-118504Gitea issue changes on archived repositories through the API6.5
  6. CVE-2026-118395Gitea public-only token bypass in repository and organization creation7.5
  7. CVE-2026-118394Gitea OAuth2 userinfo private group disclosure to public-only tokens4.3
  8. CVE-2026-117685Gitea public-only package token access to private OCI blobs9.1
  9. CVE-2026-117677Gitea Helm chart upload decompression denial of service—
  10. CVE-2026-117649Gitea private issue disclosure through issue dependency timeline events3.5
  11. CVE-2026-117646Gitea private repository listing to public-only tokens on profiles4.3
  12. CVE-2026-117635Gitea admin API public-only token scope bypass6.5
  13. CVE-2026-116474Gitea Actions job token spoofing of instance-signed commits6.5
  14. CVE-2026-116296Gitea archived repository release, milestone and label modification6.5
  15. CVE-2026-116289Gitea public-only token bypass through Actions runner registration9.1

Product grouping is registry-driven, with AI assist and human review. How it works