{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Gitea vulnerabilities","home_page_url":"https://patchfirst.co/vendor/gitea/","feed_url":"https://patchfirst.co/feed/vendor/gitea.json","description":"New and newly exploited Gitea CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-59774","url":"https://patchfirst.co/cve/CVE-2026-59774/","title":"CVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without…","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 28.3% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 78.8 of 100.","summary":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without…","date_published":"2026-10-14T00:00:00.000Z","date_modified":"2026-10-15T04:18:24.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":78.8,"kev":null,"epss":{"score":0.28308,"percentile":0.98119},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-94205","url":"https://patchfirst.co/cve/CVE-2026-94205/","title":"CVE-2026-94205: Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather…","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 24.0 of 100.","summary":"Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather…","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-13T16:41:45.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24,"kev":null,"epss":{"score":0.00622,"percentile":0.4983},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-73278","url":"https://patchfirst.co/cve/CVE-2026-73278/","title":"CVE-2026-73278: Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's…","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.8 CRITICAL. Priority 17.1 of 100.","summary":"Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's…","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-13T16:53:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.1,"kev":null,"epss":{"score":0.00466,"percentile":0.40335},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-103059","url":"https://patchfirst.co/cve/CVE-2026-103059/","title":"CVE-2026-103059: When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with…","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 0.4% (higher than 33.2% of CVEs). CVSS 9.1 CRITICAL. Priority 15.2 of 100.","summary":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with…","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-15T02:26:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.00391,"percentile":0.33249},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-101023","url":"https://patchfirst.co/cve/CVE-2026-101023/","title":"CVE-2026-101023: Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 0.4% (higher than 29% of CVEs). CVSS 9.1 CRITICAL. Priority 14.3 of 100.","summary":"Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-13T14:39:07.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00353,"percentile":0.29006},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-95106","url":"https://patchfirst.co/cve/CVE-2026-95106/","title":"CVE-2026-95106: Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject","content_text":"Gitea · Gitea. Not in CISA KEV. EPSS 0.3% (higher than 26.5% of CVEs). CVSS 9.1 CRITICAL. Priority 13.8 of 100.","summary":"Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-13T16:27:19.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.8,"kev":null,"epss":{"score":0.00332,"percentile":0.26452},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-60004","url":"https://patchfirst.co/cve/CVE-2026-60004/","title":"CVE-2026-60004: Gitea Code Injection Vulnerability","content_text":"Gitea · Gitea. In CISA KEV since 2026-08-25. ENISA EUVD lists it as exploited. EPSS 24.0% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.","summary":"Gitea Code Injection Vulnerability","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T11:41:19.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"published","priority":79.4,"kev":{"dateAdded":"2026-08-25","ransomware":false},"epss":{"score":0.23988,"percentile":0.97841},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20896","url":"https://patchfirst.co/cve/CVE-2026-20896/","title":"CVE-2026-20896: Gitea Docker image trusts spoofable reverse-proxy headers by default","content_text":"Gitea · Gitea Open Source Git Server. Not in CISA KEV. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 71.4 of 100.","summary":"Gitea Docker image trusts spoofable reverse-proxy headers by default","date_published":"2026-07-03T00:00:00.000Z","date_modified":"2026-07-07T17:00:46.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.4,"kev":null,"epss":{"score":0.02755,"percentile":0.86237},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Gitea","product":"Gitea Open Source Git Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}