VulertSecurity VulertSecurity

Vulnerability Database · Go · code.gitea.io/gitea · Version

code.gitea.io/gitea v1.27.0-dev

v1.27.0-dev is affected by 179 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 15 High 31 Medium 46 Low 10 Unrated 77

All code.gitea.io/gitea versions & vulnerabilities → Source repository Search the database for this package →
Released 07 Apr 2026 Licence MIT Also known from other sources 40 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the Go module proxy. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

code.gitea.io/gitea v1.27.0-dev vulnerabilities

179 vulnerabilities cover code.gitea.io/gitea v1.27.0-dev. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-20896: Gitea Docker Image Vulnerability Allows User Impersonation via X-WEBAUTH-USER Header 9.8 critical 1.26.3 21 Jul 2026
CVE-2026-27780: Gitea Pre-Receive Hook Scanner Errors Allow Branch-Protection Bypass 9.8 critical 1.26.0 03 Jul 2026
CVE-2026-26292: Gitea Package Vulnerability in LFS Mirror Operations Bypassing Migration Protections 9.8 critical 1.25.5 03 Jul 2026
CVE-2024-6886: Gitea Cross-site Scripting Vulnerability 9.8 critical 1.22.1 06 Aug 2024
CVE-2019-11576: Gitea Allows 1FA Even for 2FA-Enrolled Accounts 9.8 critical 1.8.0 24 May 2022
CVE-2018-18926: Remote Code Execution (RCE) in code.gitea.io/gitea 9.8 critical 1.5.2 15 Feb 2022
CVE-2021-45331: Reuse of one time passwords allowed in Gitea 9.8 critical 1.5.0 10 Feb 2022
CVE-2021-45330: Improper Privilege Management in Gitea 9.8 critical 1.6.0 10 Feb 2022
CVE-2026-58443: Gitea Public-Only Repository Token Vulnerability Allows Unauthorized Updates to Private PR Head Branches 9.6 critical 1.27.0 21 Jul 2026
CVE-2026-22874: Gitea Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter 9.6 critical 1.26.3 21 Jul 2026
CVE-2026-56750: Gitea Remember-Me Token Theft Vulnerability Leading to Session Persistence 9.1 critical 1.27.0 21 Jul 2026
CVE-2026-26232: Gitea OAuth2 Authorization Code Reuse Vulnerability 9.1 critical 1.25.5 03 Jul 2026
CVE-2026-22547: Gitea Repository Creation Lacks Sufficient Validation 9.1 critical 1.25.5 03 Jul 2026
CVE-2026-25718: Gitea Package Vulnerability in Template Repository Generation 9.1 critical 1.25.5 03 Jul 2026
CVE-2026-26247: Gitea OAuth2 PKCE S256 Verifier Bypass Vulnerability 9.1 critical 1.25.5 03 Jul 2026
CVE-2026-58424: Gitea Permanent Fork PR Workflow Approval Gate Bypass Vulnerability 8.9 high 1.26.3 21 Jul 2026
CVE-2026-27775: Gitea Cached Per-Branch Permission Check Vulnerability 8.8 high 1.26.3 21 Jul 2026
CVE-2026-58436: Gitea Locale Middleware Quadratic-Time DoS Vulnerability 8.7 high 1.27.0 21 Jul 2026
CVE-2026-56654: Gitea Privilege Escalation via Access Token Scope Escalation in API 8.7 high 1.27.0 21 Jul 2026
CVE-2018-15192: Gogs and Gitea SSRF Vulnerability 8.6 high 1.16.0-rc1 14 May 2022
CVE-2026-57894: Gitea Repository Migration Vulnerability Allows Internal Git Repository Exfiltration 8.5 high 1.27.0 21 Jul 2026
CVE-2026-26231: Gitea Authorization Bypass Vulnerability Allows Unauthorized Commits 8.5 high 1.26.2 16 Jun 2026
CVE-2026-27771: Gitea Insufficient Permission Checks for Composer Package Source Links 8.2 high 1.26.2 17 Jul 2026
CVE-2025-68939: Gitea Allows Attackers to Add Forbidden File Extensions to Attachments 8.2 high No fix published 26 Dec 2025
CVE-2026-55987: Gitea OAuth2 Sign-In Reactivates Deactivated Accounts 8.1 high 1.27.0 21 Jul 2026
CVE-2026-22555: Gitea API Fork Vulnerability Allows Unauthorized Org Secret Exfiltration 8.1 high 1.26.0 17 Jun 2026
CVE-2026-28699: Gitea OAuth2 Access Token Scope Bypass Vulnerability 8.1 high 1.26.2 16 Jun 2026
CVE-2026-28744: Gitea Git Smart HTTP Bypasses Repository Token Scopes for Bearer Tokens 8.1 high 1.26.2 16 Jun 2026
CVE-2026-58314: Gitea SSRF Vulnerability in Webhooks and OpenID Sign-in 7.7 high 1.27.0 21 Jul 2026
CVE-2026-58422: Gitea OAuth Callback Vulnerability Allows Re-enabling of Disabled Accounts 7.6 high 1.26.4 21 Jul 2026
CVE-2026-58419: Gitea Notification API Exposes Private Issue Metadata Post Access Revocation 7.5 high 1.26.4 21 Jul 2026
CVE-2026-25038: Gitea 1.26.2 Unauthorized Access to Labels of Private Organizations 7.5 high 1.26.3 21 Jul 2026
CVE-2026-24451: Gitea Fork Synchronization Vulnerability Allows Access to Private Repository Content 7.5 high 1.26.3 21 Jul 2026
CVE-2026-54481: Gitea Internal API Client Hardcodes Insecure TLS Configuration 7.5 high 1.27.0 21 Jul 2026
CVE-2026-58421: Gitea CODEOWNERS Unauthenticated ReDoS Vulnerability Leading to Denial of Service 7.5 high 1.26.4 21 Jul 2026
CVE-2026-27779: Gitea Canonical URL Spoofing via Forwarded-Proto Validation 7.5 high 1.25.5 03 Jul 2026
CVE-2026-25712: Gitea Package Exposes Hidden Membership and Private Organization Data 7.5 high 1.25.5 03 Jul 2026
CVE-2026-24690: Gitea Pull Request Branch Permission Checks Allow Unauthorized Updates and Rebases 7.5 high 1.25.5 03 Jul 2026
CVE-2026-27657: Gitea Email Ownership Bypass Vulnerability 7.5 high 1.25.5 03 Jul 2026
CVE-2026-26307: Gitea Resource Exhaustion Vulnerability in Git Grep Searches 7.5 high 1.25.5 03 Jul 2026
CVE-2026-27660: Gitea Package Exposes Draft Releases and Attachments Without Proper Permissions 7.5 high 1.25.5 03 Jul 2026
CVE-2022-30781: Shell command injection in gitea 7.5 high 1.16.7 17 May 2022
CVE-2022-27313: Arbitrary File Deletion in Gitea 7.5 high 1.16.4 04 May 2022
CVE-2026-58437: Gitea Repository Visibility Manipulation via Git Push Options 7.1 high 1.27.0 21 Jul 2026
CVE-2026-56755: Gitea Denial of Service via O(N^2) String Concatenation in Debian Package Upload 7.1 high 1.27.0 21 Jul 2026
CVE-2022-0905: Gitea Missing Authorization Vulnerability 7.1 high 1.16.4 11 Mar 2022
CVE-2026-59765: Gitea SSRF Vulnerability via Migration Asset Downloads 6.9 medium 1.27.0 21 Jul 2026
CVE-2026-56657: Gitea SSH Key Parser Denial of Service Vulnerability 6.9 medium 1.27.0 21 Jul 2026
CVE-2026-57897: Gitea Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs 6.5 medium 1.27.0 21 Jul 2026
CVE-2026-42931: Gitea Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint 6.5 medium 1.27.0 21 Jul 2026
CVE-2026-58442: Gitea Repository Migration SSRF via Multi-Answer DNS Allow-List Bypass 6.5 medium 1.27.0 21 Jul 2026
CVE-2026-58418: Gitea 1.25.4 SSRF via HTTP Redirect in Repository Migration 6.5 medium 1.26.4 21 Jul 2026
CVE-2026-58428: Gitea Release Attachment Extension Allowlist Bypass Vulnerability 6.5 medium 1.27.0 21 Jul 2026
CVE-2022-38795: Gitea Erroneous Repo Clones 6.5 medium 1.17.2 07 Aug 2023
CVE-2022-38183: Gitea - Assignment of Private Issues 6.5 medium 1.16.9 13 Aug 2022
CVE-2019-1000002: Gitea Arbitrary File Delete Vulnerability 6.5 medium 1.6.3 13 May 2022
CVE-2026-58441: Gitea SSRF Vulnerability in restore-repo Command 6.3 medium 1.27.0 21 Jul 2026
Insecure Default SSH Settings in Gitea - Moderate Vulnerability 6.3 medium 1.25.0 22 Apr 2026
CVE-2019-1010261: Gitea XSS Vulnerability 6.1 medium 1.7.1 24 May 2022
CVE-2022-1058: Gitea Open Redirect 6.1 medium 1.16.5 25 Mar 2022
CVE-2026-57886: Gitea Cross-Repository Attachment Re-linking Vulnerability 5.9 medium 1.27.0 21 Jul 2026
CVE-2026-58432: Gitea Draft Release Attachment Disclosure Vulnerability 5.9 medium 1.27.0 21 Jul 2026
Gitea Vulnerability: Anonymous Access to Private Projects 5.8 medium 1.21.2 26 Dec 2025
CVE-2026-58435: Gitea LFS Deploy-Key Privilege Escalation Vulnerability 5.4 medium 1.27.0 21 Jul 2026
CVE-2025-68946: Gitea Cross-site Scripting Vulnerability 5.4 medium 1.20.1 26 Dec 2025
CVE-2025-68942: Gitea XSS Vulnerability in Search Input Box 5.4 medium 1.22.2 26 Dec 2025
CVE-2021-28378: Cross-site Scripting in Gitea 5.4 medium 1.13.4 27 Sep 2021
CVE-2026-55982: Gitea OIDC Userinfo Endpoint Exposes Identity Claims Without Scope Enforcement 5.3 medium 1.27.0 21 Jul 2026
Authorization Bypass in Gitea: API Fork Endpoint Allows Unauthorized Repository Creation 5.3 medium 1.26.0 21 Jul 2026
CVE-2026-58507: Gitea Private Repository Existence Disclosure via go-get Meta Endpoint 5.3 medium 1.27.0 21 Jul 2026
CVE-2026-59763: Gitea Unbounded Arch Package Metadata Resource Amplification Vulnerability 5.3 medium 1.27.0 21 Jul 2026
CVE-2026-28705: Gitea Path Traversal Vulnerability in Release Asset Dumps 5.3 medium 1.25.5 03 Jul 2026
CVE-2026-20909: Gitea Package Exposes Tracked Time Entries Without Proper Authorization 5.3 medium 1.25.5 03 Jul 2026
CVE-2026-25782: Gitea Tracked-Time Deletion Vulnerability Allows Cross-Issue Deletion 5.3 medium 1.25.5 03 Jul 2026
CVE-2026-20706: Gitea Token Scope Bypass Vulnerability in Archive Download Endpoint 5.3 medium 1.26.2 16 Jun 2026
CVE-2025-69413: Gitea API User Endpoint Authentication Response Discrepancy 5.3 medium 1.25.2 01 Jan 2026
CVE-2025-68943: Gitea Login Time Disclosure Vulnerability 5.3 medium 1.21.8 26 Dec 2025
CVE-2021-29134: Path Traversal in Gitea 5.3 medium 1.13.6 16 Mar 2022
Token Scope Mismanagement in Gitea Package Registry - Moderate Vulnerability 5.0 medium 1.22.2 26 Dec 2025
CVE-2026-58429: Gitea Personal Access Token Scope Bypass in Organization Endpoints 4.9 medium 1.27.0 21 Jul 2026
CVE-2025-68941: Gitea API Token Mismanagement Leads to Unauthorized Access to Private Resources 4.9 medium 1.22.3 26 Dec 2025
CVE-2022-1928: Stored Cross-site Scripting in gitea 4.4 medium 1.16.9 30 May 2022
CVE-2026-58510: Gitea Repository Watch Persistence Issue on Public to Private Transition 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-50105: Gitea RSS/Atom Feed Token Scope Bypass Vulnerability 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-58444: Gitea Personal Access Token Scope Bypass Vulnerability 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-27761: Gitea API Token Scope Bypass Exposes Private Repository Data 4.3 medium 1.26.3 21 Jul 2026
CVE-2026-58425: Gitea OAuth Token Introspection Metadata Exposure Vulnerability 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-56443: Gitea Token Public-Only Scope Bypass Vulnerability 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-59766: Gitea Private Repo Information Leakage via User Starred and Times Endpoints 4.3 medium 1.27.0 21 Jul 2026
CVE-2026-27783: Gitea Code Access Bypass via Issue-Template API Endpoints 4.3 medium 1.26.2 16 Jun 2026
CVE-2026-25714: Gitea Incomplete Token Scope Enforcement Vulnerability 4.3 medium 1.26.2 16 Jun 2026
CVE-2025-68938: Gitea Release Deletion Authorization Vulnerability 4.3 medium 1.25.2 26 Dec 2025
CVE-2026-23603: Gitea Blind SSRF Vulnerability in OAuth2 Avatar Synchronization 3.1 low 1.27.0 21 Jul 2026
Inadequate Branch Deletion Permissions in Gitea - GHSA-rrcw-5rjv-vj26 3.1 low 1.22.5 26 Dec 2025
CVE-2023-35153: XWiki Platform AppWithinMinutes Stored XSS Vulnerability 3.0 low 1.19.4 05 Jul 2023
CVE-2023-3515: Open Redirect vulnerability in code.gitea.io/gitea 3.0 low 1.19.4 05 Jul 2023
CVE-2026-58511: Gitea Webhook Authorization Header Exposed in Plaintext via API 2.7 low 1.27.0 21 Jul 2026
CVE-2026-55984: Gitea Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service 2.7 low 1.27.0 21 Jul 2026
CVE-2026-58445: Gitea Cross-Repository Label-ID Enumeration Vulnerability 2.7 low 1.27.0 21 Jul 2026
CVE-2026-58434: Gitea Private Repository Metadata Exposure After Access Revocation 2.3 low 1.27.0 21 Jul 2026
CVE-2026-0798: Gitea Release Notification Email Leakage for Revoked Users 2.3 low 1.25.4 23 Jan 2026
CVE-2026-20736: Gitea Improper Access Control for Uploaded Attachments 2.3 low 1.25.4 23 Jan 2026
CVE-2026-25782: Gitea Package Vulnerability in Tracked-Time Deletion N/A unrated 1.25.5 10 Sep 2026
CVE-2026-26292: Gitea LFS Mirror Operations Bypass Migration HTTP Transport Protections N/A unrated 1.25.5 10 Sep 2026
CVE-2026-27779: Gitea Forwarded-Proto Validation Vulnerability Leading to Canonical URL Spoofing N/A unrated 1.25.5 10 Sep 2026
CVE-2026-27780: Gitea Pre-Receive Hook Scanner Errors Allow Branch-Protection Bypass N/A unrated 1.26.0 10 Sep 2026
CVE-2026-27660: Gitea Exposes Draft Releases and Attachments Without Write Permission N/A unrated 1.25.5 10 Sep 2026
CVE-2026-25712: Gitea Package Exposes Hidden Membership and Private Organization Data N/A unrated 1.25.5 02 Sep 2026
CVE-2026-24690: Gitea Pull Request Branch Permission Bypass Vulnerability N/A unrated 1.25.5 02 Sep 2026
CVE-2026-27657: Gitea Package Email Ownership Bypass Vulnerability N/A unrated 1.25.5 02 Sep 2026
CVE-2026-26232: Gitea OAuth2 Authorization Code Reuse Vulnerability N/A unrated 1.25.5 02 Sep 2026
CVE-2026-28705: Gitea Package Path Traversal Vulnerability N/A unrated 1.25.5 02 Sep 2026
CVE-2026-22547: Gitea Package Vulnerability in Repository Creation N/A unrated 1.25.5 02 Sep 2026
CVE-2026-20909: Gitea Exposes Tracked Time Entries Without Repository Authorization N/A unrated 1.25.5 02 Sep 2026
CVE-2026-25718: Gitea Package Vulnerability in Template Repository Generation N/A unrated 1.25.5 02 Sep 2026
CVE-2026-26307: Gitea Package Resource Exhaustion Vulnerability in Git Grep Searches N/A unrated 1.25.5 02 Sep 2026
CVE-2026-26247: Gitea OAuth2 PKCE S256 Verifier Bypass Vulnerability N/A unrated 1.25.5 02 Sep 2026
Authorization Bypass Vulnerability in Gitea: API Fork Endpoint Allows Unauthorized Repository Creation N/A unrated 1.26.0 27 Jul 2026
CVE-2026-58418: Gitea SSRF Vulnerability in Repository Migration N/A unrated 1.26.4 27 Jul 2026
CVE-2026-25038: Gitea Unauthorized Access to Labels of Private Organizations N/A unrated 1.26.3 27 Jul 2026
CVE-2026-58421: Gitea CODEOWNERS Pattern Matching Vulnerability Leading to Unauthenticated ReDoS N/A unrated 1.26.4 27 Jul 2026
CVE-2026-58439: Gitea Branch Protection Bypass via PR Retargeting N/A unrated No fix published 27 Jul 2026
CVE-2026-24451: Gitea Fork Synchronization Vulnerability After Repository Privacy Change N/A unrated 1.26.3 27 Jul 2026
CVE-2026-27771: Gitea Insufficient Permission Checks for Composer Package Source Links N/A unrated 1.26.2 22 Jul 2026
CVE-2026-28740: Gitea Git LFS Object Reuse Vulnerability Allows Unauthorized Access to Private Source Objects N/A unrated 1.26.3 22 Jul 2026
CVE-2026-22874: Gitea Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter N/A unrated 1.26.3 22 Jul 2026
CVE-2026-27761: Gitea API Token Scope Bypass Vulnerability Exposing Private Repository Data N/A unrated 1.26.3 22 Jul 2026
CVE-2026-58419: Gitea Notification API Exposes Private Issue Metadata After Access Revocation N/A unrated 1.26.4 22 Jul 2026
CVE-2026-27775: Gitea Cached Per-Branch Permission Check Vulnerability N/A unrated 1.26.3 22 Jul 2026
CVE-2026-58424: Gitea Permanent Fork PR Workflow Approval Gate Bypass Vulnerability N/A unrated 1.26.3 22 Jul 2026
CVE-2026-20896: Gitea Package Vulnerability Allows User Impersonation via X-WEBAUTH-USER N/A unrated 1.26.3 22 Jul 2026
CVE-2026-58422: Gitea OAuth Sign-in Callback Improper Authorization Vulnerability N/A unrated 1.26.4 22 Jul 2026
CVE-2026-25779: Gitea Open Redirect Vulnerability in code.gitea.io/gitea N/A unrated 1.26.0 25 Jun 2026
CVE-2026-26231: Gitea Authorization Bypass Allows Unauthorized Commits N/A unrated 1.26.2 25 Jun 2026
CVE-2026-28699: Gitea OAuth2 Access Token Scope Enforcement Bypass Vulnerability N/A unrated 1.26.2 25 Jun 2026
CVE-2026-28744: Gitea Git Smart HTTP Token Scope Bypass Vulnerability N/A unrated 1.26.2 25 Jun 2026
CVE-2026-20706: Gitea Token Scope Bypass Vulnerability in code.gitea.io/gitea N/A unrated 1.26.2 25 Jun 2026
CVE-2026-22555: Gitea Package Vulnerability Allows Org Secret Exfiltration N/A unrated 1.26.0 25 Jun 2026
CVE-2026-25714: Gitea Incomplete Fix for Token Check Vulnerability N/A unrated 1.26.2 25 Jun 2026
CVE-2026-27783: Gitea Package Vulnerability Due to Missing Repository-Unit Authorization on Issue-Template API Endpoints N/A unrated 1.26.2 25 Jun 2026
Insecure Default SSH Settings in Gitea - GO-2026-5091 N/A unrated 1.25.0 25 Jun 2026
CVE-2026-20800: Gitea Exposes Issue and Pull Request Titles N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20897: Gitea Repository Ownership Validation Flaw in Git LFS Lock Deletion N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20912: Gitea Repository Ownership Validation Flaw N/A unrated 1.25.4 02 Feb 2026
CVE-2026-0798: Gitea Release Notification Email Vulnerability for Private Repositories N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20888: Gitea Package Authorization Flaw in Auto-Merge Cancellation N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20736: Gitea Improper Access Control for Uploaded Attachments N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20883: Gitea Exposes Sensitive Information Through Stopwatches N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20904: Gitea OpenID URI Visibility Ownership Validation Flaw N/A unrated 1.25.4 02 Feb 2026
CVE-2026-20750: Gitea Project Ownership Validation Flaw N/A unrated 1.25.4 02 Feb 2026
CVE-2025-69413: Gitea's /api/v1/user Endpoint Authentication Response Discrepancy N/A unrated 1.25.2 12 Jan 2026
CVE-2025-68938: Gitea Release Deletion Authorization Vulnerability N/A unrated 1.25.2 30 Dec 2025
CVE-2025-68939: Gitea Vulnerability Allows Forbidden File Extensions in Attachments N/A unrated No fix published 30 Dec 2025
CVE-2025-68945: Gitea Package Vulnerability Allows Anonymous Access to Private Projects N/A unrated 1.21.2 30 Dec 2025
CVE-2025-68942: Gitea XSS Vulnerability in Tag and Branch Creation Input N/A unrated 1.22.2 30 Dec 2025
CVE-2025-68944: Gitea Token Scope Mismanagement in Package Registry N/A unrated 1.22.2 30 Dec 2025
CVE-2025-68946: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea N/A unrated 1.20.1 30 Dec 2025
CVE-2025-68943: Gitea Package Exposes User Login Times Through Sort Order N/A unrated 1.21.8 30 Dec 2025
CVE-2025-68940: Gitea Branch Deletion Permission Vulnerability N/A unrated 1.22.5 30 Dec 2025
CVE-2025-68941: Gitea API Token Mismanagement Leads to Unauthorized Access N/A unrated 1.22.3 30 Dec 2025
CVE-2022-42968: Argument Injection in Gitea N/A unrated 1.17.3 21 Aug 2024
CVE-2021-45330: Improper Privilege Management in Gitea N/A unrated 1.6.0 21 Aug 2024
CVE-2020-13246: Denial of Service in Gitea N/A unrated 1.12.0 21 Aug 2024
CVE-2021-28378: Cross-site Scripting in Gitea N/A unrated 1.13.4 21 Aug 2024
CVE-2018-18926: Gitea Remote Code Execution (RCE) in code.gitea.io/gitea N/A unrated 1.5.2 21 Aug 2024
Gitea Missing Authorization Vulnerability in code.gitea.io/gitea N/A unrated 1.16.4 21 Aug 2024
CVE-2022-1928: Stored Cross-site Scripting in gitea in code.gitea.io/gitea N/A unrated 1.16.9 21 Aug 2024
Arbitrary File Deletion in Gitea N/A unrated 1.16.4 21 Aug 2024
CVE-2022-30781: Shell command injection in gitea in code.gitea.io/gitea N/A unrated 1.16.7 21 Aug 2024
CVE-2021-45331: Reuse of One Time Passwords in Gitea N/A unrated 1.5.0 21 Aug 2024
CVE-2021-29134: Path Traversal in Gitea N/A unrated 1.13.6 21 Aug 2024
CVE-2021-45327: Capture-replay vulnerability in Gitea N/A unrated 1.11.2 21 Aug 2024
CVE-2022-38795: Gitea erroneous repo clones in code.gitea.io/gitea N/A unrated 1.17.2 21 Aug 2024
CVE-2018-15192: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea N/A unrated 1.16.0-rc1 20 Aug 2024
CVE-2019-1010261: Gitea XSS Vulnerability in code.gitea.io/gitea N/A unrated 1.7.1 20 Aug 2024
CVE-2023-3515: Open Redirect vulnerability in code.gitea.io/gitea N/A unrated 1.19.4 20 Aug 2024
CVE-2024-6886: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea N/A unrated 1.22.1 06 Aug 2024
CVE-2022-38183: Gitea allowed assignment of private issues in code.gitea.io/gitea N/A unrated 1.16.9 10 Jun 2024
CVE-2022-1058: Gitea Open Redirect in code.gitea.io/gitea N/A unrated 1.16.5 04 Jun 2024

Looking for another version, or everything Vulert holds for code.gitea.io/gitea?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About code.gitea.io/gitea v1.27.0-dev

Is code.gitea.io/gitea v1.27.0-dev vulnerable?

Yes. 179 vulnerabilities in the Vulert database cover code.gitea.io/gitea v1.27.0-dev: 15 critical, 31 high, 46 medium and 10 low, plus 77 not yet rated. Each entry above names the fixed version to move to.

Is v1.27.0-dev the latest release of code.gitea.io/gitea?

No. v1.27.0-dev was published 07 Apr 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor code.gitea.io/gitea for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the code.gitea.io/gitea version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.