Gitea vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 20241
3. 20259
4. 2026198

Known exploitedNewest addition to KEV first

• CVE-2026-60004

  Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

  Gitea · Gitea

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-119627

  Gitea limited-visibility profile disclosure with public-only tokens

  Gitea · Gitea

  Not scored
• CVE-2026-119625

  Gitea user and organization feed token scope bypass

  Gitea · Gitea

  Not scored
• CVE-2026-119533

  Gitea private pull request disclosure on project boards

  Gitea · Gitea

  Not scored
• CVE-2026-119441

  Gitea public-only token bypass on bulk organization repository deletion

  Gitea · Gitea

  Not scored
• CVE-2026-118504

  Gitea issue changes on archived repositories through the API

  Gitea · Gitea

  Not scored
• CVE-2026-118395

  Gitea public-only token bypass in repository and organization creation

  Gitea · Gitea

  Not scored
• CVE-2026-118394

  Gitea OAuth2 userinfo private group disclosure to public-only tokens

  Gitea · Gitea

  Not scored
• CVE-2026-117685

  Gitea public-only package token access to private OCI blobs

  Gitea · Gitea

  Not scored
• CVE-2026-117677

  Gitea Helm chart upload decompression denial of service

  Gitea · Gitea

  Not scored
• CVE-2026-117649

  Gitea private issue disclosure through issue dependency timeline events

  Gitea · Gitea

  Not scored