Skip to content
Noroxi

Gitea records

82 published records for vendor gitea.

Researcher profile

Entered KEV
1 · 1.2%
Weaponized
3 · 3.7%
Pre-auth RCE
4
With a fix record
65.9%
Median publish → KEV
-1 days

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

82 records
  • CVE-2026-60004
    76This week

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    CriticalCVSS 9.8KEVWeaponizedEPSS 23%

    gitea · giteaAug 26, 2026

  • CVE-2022-30781
    60This week

    Gitea before 1.16.7 does not escape git fetch remote.

    HighCVSS 7.5WeaponizedEPSS 87%

    gitea · giteaMay 16, 2022

  • CVE-2020-14144
    57Plan

    The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the do

    HighCVSS 7.2WeaponizedEPSS 95%

    gitea · giteaOct 16, 2020

  • CVE-2019-11229
    51Plan

    models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.

    HighCVSS 8.8Proof of conceptEPSS 54%

    gitea · giteaApr 15, 2019

  • CVE-2024-6886
    50Plan

    Inproper Sanitation of field leading to stored XSS

    CriticalCVSS 10.0Proof of conceptEPSS 32%

    gitea · gitea open source git serverAug 6, 2024

  • CVE-2022-1058
    40Plan

    Open Redirect on login in go-gitea/gitea

    MediumCVSS 6.1Proof of conceptEPSS 53%

    gitea · giteaMar 24, 2022

  • CVE-2018-18926
    40Plan

    Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs.

    CriticalCVSS 9.8No exploitEPSS 3%

    gitea · giteaNov 4, 2018

  • CVE-2021-45327
    40Plan

    Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.

    CriticalCVSS 9.8No exploitEPSS 2%

    gitea · giteaFeb 8, 2022

  • CVE-2019-11576
    40Plan

    Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment.

    CriticalCVSS 9.8No exploitEPSS 1%

    gitea · giteaApr 27, 2019

  • CVE-2020-28991
    40Plan

    Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (

    CriticalCVSS 9.8No exploitEPSS 1%

    gitea · giteaNov 23, 2020

  • CVE-2021-45330
    39Monitor

    An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and t

    CriticalCVSS 9.8No exploitEPSS 1%

    gitea · giteaFeb 9, 2022

  • CVE-2021-45331
    39Monitor

    An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges.

    CriticalCVSS 9.8No exploitEPSS 1%

    gitea · giteaFeb 9, 2022

  • CVE-2022-42968
    39Monitor

    Gitea before 1.17.3 does not sanitize and escape refs in the git backend.

    CriticalCVSS 9.8No exploitEPSS 1%

    gitea · giteaOct 16, 2022

  • CVE-2026-73278
    39Monitor

    Gitea WebAuthn bypass during OAuth and OIDC sign-in

    CriticalCVSS 9.8No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2026-94205
    39Monitor

    Gitea fork workflow approval bypass through maintainer-triggered events

    CriticalCVSS 9.8No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2026-20912
    36Monitor

    Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaJan 22, 2026

  • CVE-2026-20897
    36Monitor

    Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaJan 22, 2026

  • CVE-2026-20750
    36Monitor

    Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaJan 22, 2026

  • CVE-2026-101023
    36Monitor

    Gitea OAuth2 refresh token grant accepts access tokens

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2026-95106
    36Monitor

    Gitea review and execution mismatch through duplicate tree entries

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2026-103059
    36Monitor

    Gitea built-in SSH server authentication bypass through key case folding

    CriticalCVSS 9.1No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2018-15192
    35Monitor

    An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

    HighCVSS 8.6No exploitEPSS 2%

    gitea · giteaAug 7, 2018

  • CVE-2021-45326
    35Monitor

    Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state alte

    HighCVSS 8.8No exploitEPSS 0%

    gitea · giteaFeb 8, 2022

  • CVE-2026-104626
    35Monitor

    Gitea fork workflow job revival through later approval

    HighCVSS 8.8No exploitEPSS 0%

    gitea · giteaOct 6, 2026

  • CVE-2026-104632
    35Monitor

    Gitea fork workflow approval bypass through cancel and rerun

    HighCVSS 8.8No exploitEPSS 0%

    gitea · giteaOct 6, 2026