| CVE-2026-25712 |
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members…
|
7.5
Élevée
|
3 juil. 2026 |
| CVE-2026-25714 |
Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization…
|
4.3
Moyenne
|
3 juil. 2026 |
| CVE-2026-25038 |
Gitea 1.26.2 allows unauthorized users to access labels of private organizations
|
7.5
Élevée
|
3 juil. 2026 |
| CVE-2026-22874 |
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering
|
9.6
Critique
|
3 juil. 2026 |
| CVE-2026-24451 |
Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private,…
|
7.5
Élevée
|
3 juil. 2026 |
| CVE-2026-24690 |
Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches
|
7.5
Élevée
|
3 juil. 2026 |
| CVE-2026-22547 |
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited…
|
9.1
Critique
|
3 juil. 2026 |
| CVE-2026-22555 |
Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the…
|
8.1
Élevée
|
3 juil. 2026 |
| CVE-2026-20779 |
Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be…
|
7.1
Élevée
|
3 juil. 2026 |
| CVE-2026-20896 |
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any…
|
9.8
Critique
|
3 juil. 2026 |
| CVE-2026-20909 |
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries
|
5.3
Moyenne
|
3 juil. 2026 |
| CVE-2026-20706 |
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web…
|
9.1
Critique
|
3 juil. 2026 |
| CVE-2026-20912 |
Gitea does not properly validate repository ownership when linking attachments to releases
|
9.1
Critique
|
22 janv. 2026 |
| CVE-2026-20888 |
Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface
|
4.3
Moyenne
|
22 janv. 2026 |
| CVE-2026-20897 |
Gitea does not properly validate repository ownership when deleting Git LFS locks
|
9.1
Critique
|
22 janv. 2026 |
| CVE-2026-20904 |
Gitea does not properly validate ownership when toggling OpenID URI visibility
|
6.5
Moyenne
|
22 janv. 2026 |
| CVE-2026-20800 |
Gitea's notification API does not re-validate repository access permissions when returning notification details
|
6.5
Moyenne
|
22 janv. 2026 |
| CVE-2026-20883 |
Gitea's stopwatch API does not re-validate repository access permissions
|
6.5
Moyenne
|
22 janv. 2026 |
| CVE-2026-20736 |
Gitea does not properly verify repository context when deleting attachments
|
7.5
Élevée
|
22 janv. 2026 |
| CVE-2026-20750 |
Gitea does not properly validate project ownership in organization project operations
|
9.1
Critique
|
22 janv. 2026 |
| CVE-2026-0798 |
Gitea may send release notification emails for private repositories to users whose access has been revoked
|
3.5
Faible
|
22 janv. 2026 |
| CVE-2024-6886 |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea…
|
10.0
Critique
|
6 août 2024 |