影響を受けるバージョン系列
- 28.0 CVE 8 件
- 1.27 CVE 29 件 KEV 1
- 1.25 CVE 37 件 KEV 1
- 1.22 CVE 38 件 KEV 1
- 1.20 CVE 38 件 KEV 1
- 1.19 CVE 39 件 KEV 1
- 1.18 CVE 39 件 KEV 1
- 1.17 CVE 40 件 KEV 1
- 1.16 CVE 45 件
- 1.15 CVE 44 件
- 1.13 CVE 47 件
- 1.12 CVE 49 件
- 1.11 CVE 50 件
- 1.9 CVE 50 件
- 1.8 CVE 51 件
- 1.7 CVE 54 件
- 1.6 CVE 55 件
- 1.5 CVE 60 件
- 1.4 CVE 63 件
- 1.1 CVE 64 件
- 0.9 CVE 63 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-60004 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | ≥ 1.17.0 < 1.27.1 | 9.8 | KEV | 24.0% | 2026-08-26 |
| CVE-2026-119546 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo | * | 6.8 | — | 2026-10-30 | |
| CVE-2026-119545 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery | * | 6.9 | — | 2026-10-30 | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options | * | 8.8 | — | 2026-10-14 | |
| CVE-2026-86684 | Gitea push mirror local path check uses the repository owner | ≥ 1.18.0 < 28.1.0 | 7.1 | — | 2026-10-06 | |
| CVE-2026-89182 | Gitea push-to-create bypass of FORCE_PRIVATE policy | ≥ 1.27.0 < 28.1.0 | 5.4 | — | 2026-10-06 | |
| CVE-2026-96594 | Gitea repository media API stored XSS | < 28.1.0 | 6.1 | — | 2026-10-06 | |
| CVE-2026-97208 | Gitea push mirror API bypass of DISABLE_NEW_PUSH policy | < 28.1.0 | 4.9 | — | 2026-10-06 | |
| CVE-2026-105267 | Gitea tag delete route deletes releases without release permission | < 28.1.0 | 8.1 | — | 2026-10-06 | |
| CVE-2026-105268 | Gitea issue attachment API allows changing comment attachments | < 28.1.0 | 4.3 | — | 2026-10-06 | |
| CVE-2026-104633 | Gitea migration memory exhaustion from zero page size | < 28.1.0 | 6.5 | — | 2026-10-06 | |
| CVE-2026-101023 | Gitea OAuth2 refresh token grant accepts access tokens | < 28.1.0 | 9.1 | — | 2026-10-06 | |
| CVE-2026-96399 | Gitea denial of service through external issue tracker patterns | < 28.0.0 | 7.5 | — | 2026-10-06 | |
| CVE-2026-96400 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | < 28.0.0 | 4.3 | — | 2026-10-06 | |
| CVE-2026-96404 | Gitea installer authentication bypass for existing accounts | < 28.0.0 | 8.1 | — | 2026-10-06 | |
| CVE-2026-96580 | Gitea Actions memory exhaustion through large static matrices | < 28.0.0 | 7.5 | — | 2026-10-06 | |
| CVE-2026-96589 | Gitea private repository access retained after rejected transfer | < 28.0.0 | 4.3 | — | 2026-10-06 | |
| CVE-2026-89430 | Gitea push mirror SSRF and forced writes to internal Git hosts | < 28.0.0 | 8.1 | — | 2026-10-06 | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | < 28.0.0 | 9.8 | — | 2026-10-06 | |
| CVE-2026-95106 | Gitea review and execution mismatch through duplicate tree entries | < 28.0.0 | 9.1 | — | 2026-10-06 | |
| CVE-2026-95112 | Gitea issue reference parsing CPU exhaustion | < 28.0.0 | 6.5 | — | 2026-10-06 | |
| CVE-2026-79960 | Gitea deploy key pushes acting as the repository owner | < 28.0.0 | 7.1 | — | 2026-10-06 | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | ≥ 1.16.0 < 1.27.2 | 9.8 | — | 2026-10-06 | |
| CVE-2026-70357 | Gitea repository migration SSRF through DNS rebinding | < 28.0.0 | 7.5 | — | 2026-10-06 | |
| CVE-2026-104626 | Gitea fork workflow job revival through later approval | < 28.0.0 | 8.8 | — | 2026-10-06 | |
| CVE-2026-104632 | Gitea fork workflow approval bypass through cancel and rerun | < 28.0.0 | 8.8 | — | 2026-10-06 | |
| CVE-2026-104636 | Gitea SSRF through Git HTTP redirects in mirrors and fetches | < 28.0.0 | 7.5 | — | 2026-10-06 | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | < 28.0.0 | 9.1 | — | 2026-10-06 | |
| CVE-2026-103667 | Gitea container registry stored XSS through blob media type | < 28.0.0 | 5.4 | — | 2026-10-06 | |
| CVE-2026-103670 | Gitea trusted workflow cancellation by unapproved fork runs | < 28.0.0 | 7.5 | — | 2026-10-06 | |
| CVE-2026-101027 | Gitea migration SSRF through ALLOWED_DOMAINS address check bypass | < 28.0.0 | 7.7 | — | 2026-10-06 | |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | < 28.0.0 | 4.3 | — | 2026-10-06 | |
| CVE-2026-24791 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | * | 8.1 | — | 2026-08-14 | |
| CVE-2026-24059 | Gitea runner registration-token GET endpoint performs a write under a read-only token scope | * | 6.5 | — | 2026-08-14 | |
| CVE-2026-59765 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58510 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale wat... | * | 4.3 | — | 2026-08-14 | |
| CVE-2026-58511 | Webhook Authorization Header Returned in Plaintext via API | * | 2.7 | — | 2026-08-14 | |
| CVE-2026-59763 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads | * | 4.3 | — | 2026-08-14 | |
| CVE-2026-58508 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | * | 9.1 | — | 2026-08-14 | |
| CVE-2026-58507 | Private Repository Existence Disclosure via go-get Meta Endpoint | * | 5.3 | — | 2026-08-14 | |
| CVE-2026-58444 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses p... | * | 4.3 | — | 2026-08-14 | |
| CVE-2026-58445 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | * | 2.7 | — | 2026-08-14 | |
| CVE-2026-58443 | Public-only repository tokens can update private PR head branches | * | 9.1 | — | 2026-08-14 | |
| CVE-2026-58442 | Repository migration SSRF via multi-answer DNS allow-list bypass | * | 6.5 | — | 2026-08-14 | |
| CVE-2026-58440 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltra... | * | 6.8 | — | 2026-08-14 | |
| CVE-2026-58441 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | * | 6.3 | — | 2026-08-14 | |
| CVE-2026-58439 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | * | 8.1 | — | 2026-08-14 | |
| CVE-2026-58438 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos th... | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58436 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58437 | Repository Visibility Manipulation via Git Push Options | * | 7.1 | — | 2026-08-14 | |
| CVE-2026-58435 | Gitea LFS Deploy-Key Privilege Escalation | * | 5.4 | — | 2026-08-14 | |
| CVE-2026-58434 | Private Repository Metadata Remains Accessible After Access Revocation | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58433 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | * | 9.1 | — | 2026-08-14 | |
| CVE-2026-58432 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment... | * | 5.9 | — | 2026-08-14 | |
| CVE-2026-58429 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | * | 4.9 | — | 2026-08-14 | |
| CVE-2026-58428 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | * | 6.5 | — | 2026-08-14 | |
| CVE-2026-58431 | Public-only API token restriction is not enforced on team API routes | * | 4.3 | — | 2026-08-14 | |
| CVE-2026-58427 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58417 | REST API exposes organization membership of private organizations to public | * | 7.5 | — | 2026-08-14 | |
| CVE-2026-58420 | Local File Inclusion via file:// URI in Migration Restore | * | 4.4 | — | 2026-08-14 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。