CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Gitea API Heatmap Endpoint Information Disclosure Vulnerability (CVE-2026-114199)
[Affected Scope] Gitea versions prior to v28.3.0
[Impact] An attacker holding a user's public-only token can read contribution counts and detailed 15-minute activity time buckets originating from private repositories.
[Mitigation] Immediately upgrade Gitea instances to the patched version v28.3.0 or later.
Gitea Actions Artifact Upload Stored Cross-Site Scripting (XSS) and CSP Bypass Vulnerability (CVE-2026-113429)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
[Impact] Attackers with Actions execution privileges can upload malicious HTML artifacts to execute arbitrary scripts in the victim's browser session, potentially leading to full instance takeover if an administrator triggers the payload
[Mitigation] Immediately upgrade Gitea to version v28.3.0 or later
Gitea Actions Task Token Authorization Bypass Leading to Private Repository Metadata Disclosure (CVE-2026-112887)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
[Impact] An attacker with workflow execution privileges can abuse the Gitea Actions job token to list and retrieve metadata for all private repositories and organizations on the instance
[Mitigation] Immediately upgrade the Gitea instance to the patched version v28.3.0 or later
Gitea Remote Code Execution Vulnerability via diffpatch API and Git Hooks (CVE-2026-60004)
[Affected Scope] Gitea versions prior to 1.27.1
[Impact] Unauthenticated remote attackers can install malicious Git hooks via the diffpatch API, leading to arbitrary system command execution with Gitea server privileges.
[Mitigation] Immediately upgrade Gitea instances to version 1.27.1 or later, and disable Git Hook functionality in the configuration.