Known Vulnerabilities for products from Gitea
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Gitea".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-110324 json | Not Provided | 2026-10-18 | 2026-10-19 | |
| CVE-2026-109553 json | Not Provided | 2026-10-18 | 2026-10-19 | |
| CVE-2026-107686 json | Not Provided | 2026-10-18 | 2026-10-19 | |
| CVE-2026-105964 json | Not Provided | 2026-10-18 | 2026-10-19 | |
| CVE-2026-105640 json | Not Provided | 2026-10-05 | 2026-10-05 | |
| CVE-2026-105268 json | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accept... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-105267 json | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but s... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104976 json | Not Provided | 2026-10-05 | 2026-10-06 | |
| CVE-2026-104636 json | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but ... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104633 json | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API setting... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104632 json | Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104626 json | A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Act... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-103670 json | When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checkin... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-103667 json | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image man... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-103059 json | When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-101029 json | Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answer... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-101027 json | When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its reso... | Not Provided | 2026-10-06 | 2026-10-15 |
| CVE-2026-101023 json | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but ... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-97208 json | The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirr... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-96594 json | The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directl... | Not Provided | 2026-10-06 | 2026-10-13 |
Known software with vulnerabilities from Gitea
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Gitea | Gitea | 0.9.99 |