G
Vendor security profile1 actively exploited CVEs
gitea
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs83
Critical16
CISA KEV1
Public exploit43
Patch rate%45
Avg. CVSS6.9
12-month vulnerability rate
0
0
4
0
0
0
0
0
0
49
0
30
CVE KEV
CVE severity distribution
83toplam CVE
Critical16 (19%)
High30 (36%)
Medium33 (40%)
Low4 (5%)
Patch and exploitation view
%45
Verified patch
%1
CISA KEV
%52
Public exploit
37Patch available
0Partial
1Workaround
0Vendor: no patch
45Unknown
Latest vulnerabilities
4.3
CVE-2026-97626
Gitea profile feed disclosure bypassing user visibility
G
Patch verifiedEPSS %0
6.1
CVE-2026-96594
Gitea repository media API stored XSS
G
Patch verifiedEPSS %0
5.4
CVE-2026-89182
Gitea push-to-create bypass of FORCE_PRIVATE policy
G
Patch verifiedEPSS %0
4.3
CVE-2026-105268
Gitea issue attachment API allows changing comment attachments
G
Patch verifiedEPSS %0
8.1
CVE-2026-105267
Gitea tag delete route deletes releases without release permission
G
Patch verifiedEPSS %0
6.5
CVE-2026-104633
Gitea migration memory exhaustion from zero page size
G
Patch verifiedEPSS %0
9.1
CVE-2026-101023
Gitea OAuth2 refresh token grant accepts access tokens
G
Patch verifiedEPSS %0
4.9
CVE-2026-97208
Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
G
Patch verifiedEPSS %0
7.1
CVE-2026-86684
Gitea push mirror local path check uses the repository owner
G
Patch verifiedEPSS %0
9.8
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in
G
Patch verifiedEPSS %0