CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 08:40 UTC )
This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,437 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product gitea:gitea . Show all products
98 CVEs, showing 51 to 98 Previous Page 2 of 2 CVE Severity Title Published CVE-2026-97626 Medium 4.3 Gitea profile feed disclosure bypassing user visibility Assigned by Gitea
Oct 6, 2026 CVE-2026-25946 Medium 5.3 Gitea OpenID discovery server-side request forgery Assigned by Gitea
Oct 14, 2026 CVE-2026-59766 Medium 4.3 Gitea private repository metadata disclosure after access revocation Assigned by Gitea
Oct 14, 2026 CVE-2026-59774 Critical 9.8 Gitea Org-mode file disclosure and code execution Assigned by Gitea
Oct 14, 2026 CVE-2026-60008 Low 3.5 Gitea Jupyter notebook UI redress through CSS class injection Assigned by Gitea
Oct 14, 2026 CVE-2026-60010 Medium 6.5 Gitea organization team policy bypass through repository API Assigned by Gitea
Oct 14, 2026 CVE-2026-60018 Medium 6.5 Gitea OneDev migration denial of service Assigned by Gitea
Oct 14, 2026 CVE-2026-60021 Medium 6.5 Gitea GitLab migration denial of service Assigned by Gitea
Oct 14, 2026 CVE-2026-62925 Medium 6.5 Gitea Alpine package parsing memory exhaustion Assigned by Gitea
Oct 14, 2026 CVE-2026-63021 Medium 6.5 Gitea Swift package manifest memory exhaustion Assigned by Gitea
Oct 14, 2026 CVE-2026-63792 Medium 5.3 Gitea private reusable workflow disclosure to fork runs Assigned by Gitea
Oct 14, 2026 CVE-2026-66849 Medium 4.3 Gitea restricted-user package visibility bypass Assigned by Gitea
Oct 14, 2026 CVE-2026-66853 Medium 4.3 Gitea restricted-user organization metadata disclosure Assigned by Gitea
Oct 14, 2026 CVE-2026-66874 Medium 6.5 Gitea required Actions check bypass through skipped workflows Assigned by Gitea
Oct 14, 2026 CVE-2026-66877 High 8.1 Gitea fork workflow approval bypass through concurrency cancellation Assigned by Gitea
Oct 14, 2026 CVE-2026-67577 Medium 4.3 Gitea restricted-user activity and heatmap disclosure Assigned by Gitea
Oct 14, 2026 CVE-2026-68957 Medium 4.3 Gitea restricted-user issue search disclosure Assigned by Gitea
Oct 14, 2026 CVE-2026-68964 Medium 4.3 Gitea restricted-user SSH and GPG key metadata disclosure Assigned by Gitea
Oct 14, 2026 CVE-2026-70396 Medium 5.4 Gitea organization repository creation token scope bypass Assigned by Gitea
Oct 14, 2026 CVE-2026-70400 Medium 5.4 Gitea private migration creation with public-only tokens Assigned by Gitea
Oct 14, 2026 CVE-2026-70402 Medium 5.8 Gitea local code execution through writable Git hooks Assigned by Gitea
Oct 14, 2026 CVE-2026-70406 Medium 6.5 Gitea private comparison disclosure with public-only tokens Assigned by Gitea
Oct 14, 2026 CVE-2026-70407 Medium 4.3 Gitea organization listing token scope bypass Assigned by Gitea
Oct 14, 2026 CVE-2026-71184 High 8.8 Gitea fork workflow approval bypass through review events Assigned by Gitea
Oct 14, 2026 CVE-2026-71301 Medium 4.3 Gitea private pull request title disclosure through markup Assigned by Gitea
Oct 14, 2026 CVE-2026-73126 Medium 4.3 Gitea private workflow badge token scope bypass Assigned by Gitea
Oct 14, 2026 CVE-2026-73130 Medium 4.3 Gitea repository initialization resource exhaustion Assigned by Gitea
Oct 14, 2026 CVE-2026-73135 Medium 5.3 Gitea hidden-owner repository listing disclosure Assigned by Gitea
Oct 14, 2026 CVE-2026-73273 Medium 4.3 Gitea Maven checksum upload quota bypass and memory exhaustion Assigned by Gitea
Oct 14, 2026 CVE-2026-73535 High 8.8 Gitea second-factor bypass through OpenID identity linking Assigned by Gitea
Oct 14, 2026 CVE-2026-73539 High 7.5 Gitea external renderer argument injection and code execution Assigned by Gitea
Oct 14, 2026 CVE-2026-73800 High 8.8 Gitea reusable workflow secret exposure in pull_request_target Assigned by Gitea
Oct 14, 2026 CVE-2026-73804 High 8.1 Gitea API token scope escalation through HTTP signatures Assigned by Gitea
Oct 14, 2026 CVE-2026-73814 Medium 6.5 Gitea repository ownership escalation by administrators Assigned by Gitea
Oct 14, 2026 CVE-2026-78231 Medium 5.3 Gitea blind SSRF through OpenID assertion verification Assigned by Gitea
Oct 14, 2026 CVE-2026-78433 Medium 5.9 Gitea private attachment disclosure through repository mismatch Assigned by Gitea
Oct 14, 2026 CVE-2026-104627 Not yet scored Gitea OpenID account linking without session binding Assigned by Gitea
Oct 18, 2026 CVE-2026-109553 Not yet scored Gitea SSH certificate principal impersonation of other users Assigned by Gitea
Oct 18, 2026 CVE-2026-105661 Not yet scored Gitea panic on the repositories route of individual users Assigned by Gitea
Oct 18, 2026 CVE-2026-105964 Not yet scored Gitea Actions artifact v4 API unbounded request body Assigned by Gitea
Oct 18, 2026 CVE-2026-107618 Not yet scored Gitea cross-site request forgery on repository topics Assigned by Gitea
Oct 18, 2026 CVE-2026-107686 Not yet scored Gitea reactions accepted on locked issues and comments Assigned by Gitea
Oct 18, 2026 CVE-2026-109844 Not yet scored Gitea watched repositories API disclosure after access revocation Assigned by Gitea
Oct 18, 2026 CVE-2026-110311 Not yet scored Gitea draft release creation disclosing attachment metadata Assigned by Gitea
Oct 18, 2026 CVE-2026-110324 Not yet scored Gitea private profile information disclosure through POST request Assigned by Gitea
Oct 18, 2026 CVE-2026-110494 Not yet scored Gitea release attachment re-linking of issue attachments Assigned by Gitea
Oct 18, 2026 CVE-2026-97204 Not yet scored Gitea label deletion across repository and organization IDs Assigned by Gitea
Oct 18, 2026 CVE-2026-97859 Not yet scored Gitea API disclosure of private user social graph, keys and stars Assigned by Gitea
Oct 18, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
