Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.5Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory.EPSS 0.5%Oct 14, 2026
- Medium6.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts.EPSS 0.5%Oct 14, 2026
- UnknownGitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context.EPSS 0.3%Oct 14, 2026
- Medium6.5Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout.EPSS 0.5%Oct 14, 2026
- Medium6.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdmin…EPSS 0.5%Oct 14, 2026
- Low3.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in…EPSS 0.4%Oct 14, 2026
- Critical9.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files.EPSS 28.3%Oct 14, 2026
- Medium4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user.EPSS 0.3%Oct 14, 2026
- Medium5.3When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses.EPSS 0.4%Oct 14, 2026
- High8.8Gitea fork workflow approval bypass through review eventsEPSS 0.5%Oct 14, 2026
- High8.1Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.EPSS 0.4%Oct 14, 2026
- CriticalGitea fork workflow approval bypass through maintainer-triggered eventsOct 14, 2026
- MediumGitea issue attachment API allows changing comment attachmentsEPSS 0.2%Oct 14, 2026
- HighGitea SSRF through Git HTTP redirects in mirrors and fetchesEPSS 0.3%Oct 14, 2026
- HighGitea fork workflow job revival through later approvalEPSS 0.3%Oct 14, 2026
- MediumGitea private repository access retained after rejected transferEPSS 0.2%Oct 13, 2026
- HighGitea expanded a workflow's static into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied.EPSS 0.4%Oct 13, 2026
- HighWhen Gitea's web installer is reachable against a database that already contains users, such as after has been reset to , submitting the install form with an administr…EPSS 0.4%Oct 13, 2026
- MediumGitea migration SSRF to reserved addresses through ALLOWED_DOMAINSEPSS 0.2%Oct 13, 2026
- HighA repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references…EPSS 0.4%Oct 13, 2026
- High7.5When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval.EPSS 0.2%Oct 6, 2026
- Medium5.4Gitea container registry stored XSS through blob media typeEPSS 0.2%Oct 6, 2026
- Critical9.1Gitea built-in SSH server authentication bypass through key case foldingEPSS 0.3%Oct 6, 2026
- Medium4.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated…EPSS 0.2%Oct 6, 2026
- High7.7When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions.EPSS 0.2%Oct 6, 2026