LOWGo
GHSA-2vgv-hgv4-22mh· BIT-gitea-2026-20800, CVE-2026-20800Gitea improperly exposes issue and pull request titles
Modified: 2/3/2026
package
Go/github.com/go-gitea/gitea
pkg:go/github.com/go-gitea/gitea
MEDIUM6.1Go
GHSA-36h2-95gj-w488· BIT-gitea-2021-45328, CVE-2021-45328Open redirect in Gitea
Modified: 8/21/2024
MEDIUMGo
GHSA-393c-qgvj-3xph· BIT-gitea-2026-20897, CVE-2026-20897Gitea does not properly validate repository ownership when deleting Git LFS locks
Modified: 2/3/2026
HIGH8.8Go
GHSA-4wp3-8q92-mh8w· BIT-gitea-2021-45326, CVE-2021-45326Cross Site Request Forgery in Gitea
Modified: 8/21/2024
MEDIUMGo
GHSA-4xx9-vc8v-87hv· BIT-gitea-2026-20912, CVE-2026-20912Gitea does not properly validate repository ownership when linking attachments to releases
Modified: 2/3/2026
MEDIUM5.3Go
GHSA-8h8p-x289-vvqr· BIT-gitea-2021-45325, CVE-2021-45325Gitea displaying raw OpenID error in UI
Modified: 8/21/2024
MEDIUMGo
GHSA-9cgq-wp42-4rpq· BIT-gitea-2026-20888, CVE-2026-20888Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface
Modified: 2/3/2026
HIGH7.0Go
GHSA-9f8c-pfvv-p4gm· BIT-gitea-2021-3382, CVE-2021-3382Buffer Overflow in gitea
Modified: 6/4/2024
MEDIUM5.3Go
GHSA-f5fj-7265-jxhj· CVE-2018-1000803, GO-2022-0823Gitea Exposes Private Email Addresses
Modified: 8/21/2024
HIGH7.5Go
GHSA-g2qx-6ghw-67hm· BIT-gitea-2020-13246, CVE-2020-13246Denial of Service in Gitea
Modified: 8/21/2024
HIGH8.1Go
GHSA-hpmr-prr2-cqc4· CVE-2019-11229, GO-2022-0846Gitea Remote Code Execution
Modified: 8/21/2024
MEDIUMGo
GHSA-j5r2-4c8j-xc3m· CVE-2026-25779, GO-2026-5448Gitea: Open Redirect via redirect_to
Modified: 6/25/2026
LOWGo
GHSA-j8xr-c56q-m8jj· BIT-gitea-2026-20883, CVE-2026-20883Gitea improperly exposes issue titles and repository names through previously started stopwatches
Modified: 2/3/2026
CRITICAL9.8Go
GHSA-jrpg-35hw-m4p9· BIT-gitea-2021-45327, CVE-2021-45327Capture-replay in Gitea
Modified: 8/21/2024
HIGH7.5Go
GHSA-q47x-6mqq-4w92· CVE-2019-11228, GO-2022-0862Gitea Improper Input Validation
Modified: 8/21/2024
MEDIUMGo
GHSA-qqgv-v353-cv8p· BIT-gitea-2026-20904, CVE-2026-20904Gitea does not properly validate ownership when toggling OpenID URI visibility
Modified: 2/3/2026
MEDIUM6.1Go
GHSA-r3gq-wxqf-q4gh· BIT-gitea-2021-45329, CVE-2021-45329Cross-site Scripting in Gitea
Modified: 8/21/2024
CRITICAL9.8Go
GHSA-r7h7-chh4-5rvm· BIT-gitea-2020-28991, CVE-2020-28991Improper Access Control in Gitea
Modified: 4/24/2024
MEDIUMGo
GHSA-rw22-5hhq-pfpf· BIT-gitea-2026-20750, CVE-2026-20750Gitea does not properly validate project ownership in organization project operations
Modified: 2/3/2026
CRITICAL9.8Go
GHSA-w8xw-7crf-h23x· BIT-gitea-2022-42968, CVE-2022-42968Gitea vulnerable to Argument Injection
Modified: 8/21/2024
—Go
GO-2022-0308· BIT-gitea-2021-45325, CVE-2021-45325Gitea displaying raw OpenID error in UI in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0309· BIT-gitea-2021-45326, CVE-2021-45326Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0314· BIT-gitea-2021-45329, CVE-2021-45329Cross-site Scripting in Gitea in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0579· BIT-gitea-2021-45328, CVE-2021-45328Open redirect in Gitea in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0823· CVE-2018-1000803, GHSA-f5fj-7265-jxhjGitea Exposes Private Email Addresses in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0846· CVE-2019-11229, GHSA-hpmr-prr2-cqc4Gitea Remote Code Execution in github.com/go-gitea/gitea
Modified: 3/3/2026
—Go
GO-2022-0862· CVE-2019-11228, GHSA-q47x-6mqq-4w92Gitea Improper Input Validation in github.com/go-gitea/gitea
Modified: 3/3/2026