gitea

Top products

The 15 most recently published vulnerabilities affecting gitea.

• CVE-2026-34966Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass7.6Aug 5, 2026
• CVE-2026-58426Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write9.6Jul 3, 2026
• CVE-2026-58422Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts9.8Jul 3, 2026
• CVE-2026-58424Permanent Fork PR Workflow Approval Gate Bypass8.9Jul 3, 2026
• CVE-2026-58423LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories7.7Jul 3, 2026
• CVE-2026-58421Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service7.5Jul 3, 2026
• CVE-2026-58419Notification API leaks private issue metadata after access revocation7.5Jul 3, 2026
• CVE-2026-58418SSRF via HTTP Redirect in Repository Migration6.5Jul 3, 2026
• CVE-2026-28744Gitea Git smart HTTP bypasses repository token scopes for bearer tokens8.1Jul 3, 2026
• CVE-2026-28737Gitea 3D file viewer allows stored XSS through glTF extensionsRequired8.7Jul 3, 2026
• CVE-2026-28705Gitea repository dumps write release assets using unsafe path names5.3Jul 3, 2026
• CVE-2026-28740Gitea LFS object reuse bypasses Code-unit authorization7.1Jul 3, 2026
• CVE-2026-27783Gitea issue-template APIs bypass repository unit authorization4.3Jul 3, 2026
• CVE-2026-28699Gitea Basic Auth bypasses OAuth2 access token scopes8.1Jul 3, 2026
• CVE-2026-27779Gitea forwarded-proto handling allows public URL spoofing7.5Jul 3, 2026