Skip to content
OpenAdvisories

Vendor

Gitea

210 known vulnerabilities.

Products

Gitea 111 Gitea Open Source Git Server 97 Gitea Runner 1 act_runner 1
All Critical High Medium Low Exploited only Public exploit

210 results · Feed

  • Medium 5.0
    CVE-2025-68944

    Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries

    Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.3
    CVE-2025-68943

    Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

    Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.4
    CVE-2025-68942

    Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

    Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 4.9
    CVE-2025-68941

    Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

    Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

    Gitea Gitea code.gitea.io/gitea Go
  • Low 3.1
    CVE-2025-68940

    Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

    In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

    Gitea Gitea code.gitea.io/gitea Go
  • High 8.2
    CVE-2025-68939

    Gitea allows attackers to add attachments with forbidden file extensions

    Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 4.3
    CVE-2025-68938

    Gitea mishandles authorization for deletion of releases

    Gitea before 1.25.2 mishandles authorization for deletion of releases.

    Gitea Gitea code.gitea.io/gitea Go
  • Critical 10.0
    CVE-2024-6886 Scanner template EPSS 33%

    Inproper Sanitation of field leading to stored XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Medium 6.1
    CVE-2019-1010261

    Gitea XSS Vulnerability

    Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack ve…

    Gitea Gitea code.gitea.io/gitea golang-code.gitea-git Ubuntu Go
  • Medium 6.1
    CVE-2019-1010314

    Gitea XSS Vulnerability in Repository Description

    Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and…

    Gitea Gitea code.gitea.io/gitea golang-code.gitea-git Ubuntu Go