G
Vendor security profile1 actively exploited CVEs
gitea
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs92
Critical16
CISA KEV1
Public exploit46
Patch rate%53
Avg. CVSS6.7
12-month vulnerability rate
0
9
4
0
0
0
0
0
0
49
0
30
CVE KEV
CVE severity distribution
92toplam CVE
Critical16 (17%)
High30 (33%)
Medium42 (46%)
Low4 (4%)
Patch and exploitation view
%53
Verified patch
%1
CISA KEV
%50
Public exploit
49Patch available
0Partial
0Workaround
0Vendor: no patch
43Unknown
Latest vulnerabilities
4.3
CVE-2026-97626
Gitea profile feed disclosure bypassing user visibility
G
Patch verifiedEPSS %0
6.1
CVE-2026-96594
Gitea repository media API stored XSS
G
Patch verifiedEPSS %0
5.4
CVE-2026-89182
Gitea push-to-create bypass of FORCE_PRIVATE policy
G
Patch verifiedEPSS %0
4.3
CVE-2026-105268
Gitea issue attachment API allows changing comment attachments
G
Patch verifiedEPSS %0
8.1
CVE-2026-105267
Gitea tag delete route deletes releases without release permission
G
Patch verifiedEPSS %0
6.5
CVE-2026-104633
Gitea migration memory exhaustion from zero page size
G
Patch verifiedEPSS %0
9.1
CVE-2026-101023
Gitea OAuth2 refresh token grant accepts access tokens
G
Patch verifiedEPSS %0
4.9
CVE-2026-97208
Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
G
Patch verifiedEPSS %0
7.1
CVE-2026-86684
Gitea push mirror local path check uses the repository owner
G
Patch verifiedEPSS %0
9.8
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in
G
Patch verifiedEPSS %0