Patchfirst: Gitea vulnerabilitieshttps://patchfirst.co/vendor/gitea/New and newly exploited Gitea CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without…https://patchfirst.co/cve/CVE-2026-59774/CVE-2026-59774Wed, 14 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 28.3% (higher than 98.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 78.8 of 100.public-exploitCVE-2026-94205: Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather…https://patchfirst.co/cve/CVE-2026-94205/CVE-2026-94205Tue, 06 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 0.6% (higher than 49.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 24.0 of 100.public-exploitCVE-2026-73278: Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's…https://patchfirst.co/cve/CVE-2026-73278/CVE-2026-73278Tue, 06 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.8 CRITICAL. Priority 17.1 of 100.CVE-2026-103059: When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with…https://patchfirst.co/cve/CVE-2026-103059/CVE-2026-103059Tue, 06 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 0.4% (higher than 33.2% of CVEs). CVSS 9.1 CRITICAL. Priority 15.2 of 100.CVE-2026-101023: Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant…https://patchfirst.co/cve/CVE-2026-101023/CVE-2026-101023Tue, 06 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 0.4% (higher than 29% of CVEs). CVSS 9.1 CRITICAL. Priority 14.3 of 100.CVE-2026-95106: Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks rejecthttps://patchfirst.co/cve/CVE-2026-95106/CVE-2026-95106Tue, 06 Oct 2026 00:00:00 GMTGitea · Gitea. Not in CISA KEV. EPSS 0.3% (higher than 26.4% of CVEs). CVSS 9.1 CRITICAL. Priority 13.8 of 100.CVE-2026-60004: Gitea Code Injection Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-60004/CVE-2026-60004Wed, 26 Aug 2026 00:00:00 GMTGitea · Gitea. In CISA KEV since 2026-08-25. ENISA EUVD lists it as exploited. EPSS 24.0% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.4 of 100.kevpublic-exploitT1190T1059CVE-2026-20896: Gitea Docker image trusts spoofable reverse-proxy headers by defaulthttps://patchfirst.co/cve/CVE-2026-20896/CVE-2026-20896Fri, 03 Jul 2026 00:00:00 GMTGitea · Gitea Open Source Git Server. Not in CISA KEV. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 71.4 of 100.public-exploit