Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-59774exploit ×4 | 9.8 critical | 28.0% | no CPE yet | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account. | 15 Oct |
| CVE-2026-20896exploit ×8 | 9.8 critical | 3.0% | no CPE yet | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled. | Sun 25 Oct |
| CVE-2026-27771exploit ×2 | 8.2 high | 1.0% | no CPE yet | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. | Sun 25 Oct |
| CVE-2026-28699exploit | 8.1 high | 1.0% | no CPE yet | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. | Sun 25 Oct |
| CVE-2026-22874exploit ×2 | 9.6 critical | 0.00% | no CPE yet | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. | Sun 25 Oct |
| CVE-2026-97859exploit ×3 | 6.5 medium | 0.00% | no CPE yet | Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user with limited or private visibility, whom they could not otherwise see. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0. | 19 Oct |
| CVE-2025-69413exploit | 5.3 medium | 0.00% | gitea | In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. | 14 Oct |
7 of 7
Download these 7 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.