Gitea
Number 88 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
210
Critical
33
High
64
Known Exploited
1
Exploit available
1
Network, no login needed
36.5%
Of 208 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 198 | 32 | 63 | 95 | 8 | 0 |
| 2025 | 9 | 0 | 1 | 7 | 1 | 0 |
| 2024 | 1 | 1 | 0 | 0 | 0 | 0 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2019 | 2 | 0 | 0 | 0 | 0 | 2 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Gitea | 111 | 37 |
| Gitea Open Source Git Server | 97 | 58 |
| Gitea Runner | 1 | 1 |
| act_runner | 1 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Improper Access Control | 49 | 24 |
| Incorrect Authorization | 36 | 19 |
| Information Disclosure | 23 | 6 |
| Server-Side Request Forgery | 13 | 7 |
| Missing Authorization | 10 | 4 |
| Authentication Issues | 9 | 8 |
| Denial of Service | 9 | 2 |
| Cross-Site Scripting | 8 | 2 |
| Insecure Direct Object Reference | 8 | 2 |
| Privilege Escalation | 3 | 2 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-60004 | Gitea: Code Injection | Critical | 24.0% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-120263 | Gitea OAuth2 account auto-linking takeover through the sign-up form | Critical | 0.3% | |
| CVE-2026-119627 | Gitea limited-visibility profile disclosure with public-only tokens | Medium | 0.3% | |
| CVE-2026-119625 | Gitea user and organization feed token scope bypass | Medium | 0.2% | |
| CVE-2026-119533 | Gitea private pull request disclosure on project boards | High | 0.3% | |
| CVE-2026-119441 | Gitea public-only token bypass on bulk organization repository deletion | High | 0.3% | |
| CVE-2026-118504 | Gitea issue changes on archived repositories through the API | Medium | 0.3% | |
| CVE-2026-118395 | Gitea public-only token bypass in repository and organization creation | High | 0.3% | |
| CVE-2026-118394 | Gitea OAuth2 userinfo private group disclosure to public-only tokens | Medium | 0.2% | |
| CVE-2026-118386 | Gitea Actions fork workflow trust through pull request review commit | Medium | 0.2% | |
| CVE-2026-117685 | Gitea public-only package token access to private OCI blobs | Critical | 0.3% |