code.gitea.io/gitea vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-28744Highcode.gitea.io/gitea: Gitea: Git Smart HTTP Skips Repository Token Scopes for Bearer TokensGHSA-3M6Q-H5GJ-7MRWMediumcode.gitea.io/gitea: Gitea has insecure default SSH settingsCVE-2026-20736Lowcode.gitea.io/gitea: Gitea has improper access control for uploaded attachmentsCVE-2026-0798Lowcode.gitea.io/gitea: Gitea may send release notification emails for private repositories to users whose access has been revokedCVE-2025-69413Mediumcode.gitea.io/gitea: Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username existsCVE-2025-68945Mediumcode.gitea.io/gitea: Gitea: anonymous user can visit private user's projectCVE-2025-68946Mediumcode.gitea.io/gitea: Gitea vulnerable to Cross-site ScriptingCVE-2025-68943Mediumcode.gitea.io/gitea: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort orderCVE-2025-68944Mediumcode.gitea.io/gitea: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registriesCVE-2025-68942Mediumcode.gitea.io/gitea: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-textCVE-2025-68940Lowcode.gitea.io/gitea: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.CVE-2025-68941Mediumcode.gitea.io/gitea: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resourcesCVE-2025-68939Highcode.gitea.io/gitea: Gitea allows attackers to add attachments with forbidden file extensionsCVE-2025-68938Mediumcode.gitea.io/gitea: Gitea mishandles authorization for deletion of releasesCVE-2024-6886Criticalcode.gitea.io/gitea: Gitea Cross-site Scripting VulnerabilityCVE-2020-14144Highcode.gitea.io/gitea: Arbitrary Code Execution in GiteaCVE-2022-38795Mediumcode.gitea.io/gitea: Gitea erroneous repo clonesCVE-2023-3515Lowcode.gitea.io/gitea: code.gitea.io/gitea Open Redirect vulnerabilityCVE-2022-38183Mediumcode.gitea.io/gitea: Gitea allowed assignment of private issuesCVE-2022-1928Mediumcode.gitea.io/gitea: Stored Cross-site Scripting in giteaCVE-2019-1010261Mediumcode.gitea.io/gitea: Gitea XSS VulnerabilityCVE-2019-1010314Mediumcode.gitea.io/gitea: Gitea XSS Vulnerability in Repository DescriptionCVE-2019-11576Criticalcode.gitea.io/gitea: Gitea Allows 1FA Even for 2FA-Enrolled AccountsCVE-2022-30781Highcode.gitea.io/gitea: Shell command injection in giteaCVE-2018-15192Highcode.gitea.io/gitea: Gogs and Gitea SSRF Vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo