Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73273 | medium | 4.3 | No | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated... | 2026-10-14 |
| CVE-2026-73135 | medium | 5.3 | No | Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories wh... | 2026-10-14 |
| CVE-2026-73130 | medium | 4.3 | No | Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits... | 2026-10-14 |
| CVE-2026-73126 | medium | 4.3 | No | Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authentica... | 2026-10-14 |
| CVE-2026-71301 | medium | 4.3 | No | Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.... | 2026-10-14 |
| CVE-2026-70407 | medium | 4.3 | No | Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, ca... | 2026-10-14 |
| CVE-2026-70406 | medium | 6.5 | No | Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:rep... | 2026-10-14 |
| CVE-2026-70402 | medium | 5.8 | No | Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permiss... | 2026-10-14 |
| CVE-2026-70400 | medium | 5.4 | No | Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token... | 2026-10-14 |
| CVE-2026-68964 | medium | 4.3 | No | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A restricted account can... | 2026-10-14 |
| CVE-2026-68957 | medium | 4.3 | No | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository o... | 2026-10-14 |
| CVE-2026-67577 | medium | 4.3 | No | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limite... | 2026-10-14 |
| CVE-2026-66874 | medium | 6.5 | No | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow bran... | 2026-10-14 |
| CVE-2026-66853 | medium | 4.3 | No | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visi... | 2026-10-14 |
| CVE-2026-66849 | medium | 4.3 | No | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted a... | 2026-10-14 |
| CVE-2026-63792 | medium | 5.3 | No | Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An a... | 2026-10-14 |
| CVE-2026-66057 | not reported | — | No | Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled... | 2026-10-14 |
| CVE-2026-63021 | medium | 6.5 | No | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before readi... | 2026-10-14 |
| CVE-2026-62925 | medium | 6.5 | No | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency... | 2026-10-14 |
| CVE-2026-60018 | medium | 6.5 | No | Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a ti... | 2026-10-14 |