Product by Go
Gitea.dev
13 known vulnerabilities in Gitea.dev (Go), 1 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-60004 | Gitea: Remote Code Execution via diffpatch Git Hook Installation In CISA KEValso in 3 other products | 9.8 | |
| Critical | CVE-2026-56443 | Gitea Open Source Git Server: Incorrect Authorization | 9.6 | |
| High | CVE-2026-58438 | Gitea Open Source Git Server: Missing Authorization | 7.5 | |
| High | CVE-2026-58427 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | 7.5 | |
| High | CVE-2026-58417 | REST API exposes organization membership of private organizations to public | 7.5 | |
| High | CVE-2026-34966 | Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass | 7.6 | |
| Medium | CVE-2026-58440 | Gitea Open Source Git Server: Improper Access Control | 6.8 | |
| High | CVE-2026-59765 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | 7.5 | |
| High | CVE-2026-58416 | Gitea Open Source Git Server: Improper Handling of Insufficient Permissions or Privileges | 7.1 | |
| High | CVE-2026-28740 | Gitea LFS object reuse bypasses Code-unit authorization | 7.1 | |
| Medium | CVE-2026-58420 | Local File Inclusion via file:// URI in Migration Restore | 4.4 | |
| Medium | CVE-2026-56657 | Gitea SSH Key Parser Denial of Service | 6.2 | |
| Medium | CVE-2026-58431 | Public-only API token restriction is not enforced on team API routes | 4.3 |
News
- CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlinessans-newsbites-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payloadthehackernews,
- CISA Warns of Exploited Gitea Vulnerabilitysecurityweek,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commandsthehackernews,