Vendor

Gitea

1 of 8 Gitea CVEs in Patchfirst (13%) are in of vulnerabilities exploited in the wild.

CVEs: 8
In CISA KEV: 113%
Known ransomware use: 0
Median days to KEV: –; from publication
Latest KEV listing: 25 Aug 2026

Watch Gitea Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Gitea In KEV: 1 CVEs: 7
Gitea Open Source Git Server In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Gitea CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 1
T1059Command and Scripting Interpreter CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/gitea.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Gitea CVEs linked to the technique. Each link’s provenance is on the CVE page.

Gitea CVEs

8 CVEs, by priority

CVE-2026-60004Gitea Code Injection Vulnerability
Gitea · GiteaKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
24.0%Top 2.2%
79.4priority
CVE-2026-59774Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without…
Gitea · GiteaPublic exploitCritical · 9.8
28.3%Top 1.9%
78.8priority
CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by default
Gitea · Gitea Open Source Git ServerPublic exploitCritical · 9.8
2.8%Top 14%
71.4priority
CVE-2026-94205Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather…
Gitea · GiteaPublic exploitCritical · 9.8
0.6%Top 50%
24.0priority
CVE-2026-73278Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's…
Gitea · GiteaCritical · 9.8
0.5%Top 60%
17.1priority
CVE-2026-103059When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with…
Gitea · GiteaCritical · 9.1
0.4%Top 67%
15.2priority
CVE-2026-101023Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…
Gitea · GiteaCritical · 9.1
0.4%Top 71%
14.3priority
CVE-2026-95106Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject
Gitea · GiteaCritical · 9.1
0.3%Top 74%
13.8priority