Gitea vulnerabilities
- Gitea has 188 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #69 of 420 vendors on this site by that count.
- Of the 187 with a CVSS score, 90 (48.1%) are rated critical or high; 1 (0.5% of all) have no CVSS score.
- 1 vulnerability attributed to Gitea is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-60004, was added on 25 Aug 2026.
- It is marked as known to be used in ransomware campaigns.
- For the 1 KEV entry with a published CVE record, the median KEV listing came 1 day before the CVE record was published.
Records are attributed to Gitea from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 2 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 1 |
| 2025 | 9 |
| 2026 | 178 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 178 | 29 | 59 | 49.7% | 0.6% |
| 2025 | 9 | 0 | 1 | 11.1% | 0% |
| 2024 | 1 | 1 | 0 | 100% | 0% |
| 2023 | 0 | 0 | 0 | — | — |
| 2022 | 0 | 0 | 0 | — | — |
| 2021 | 0 | 0 | 0 | — | — |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 2 | 0 | 0 | — | 100% |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-60004 | Gitea | Gitea Code Injection Vulnerability | 2026-08-25 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Gitea records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2024-6886 | 33% | 98.4% | Critical | No |
| CVE-2026-59774 | 28.3% | 98.1% | Critical | No |
| CVE-2026-60004 | 24% | 97.8% | Critical | Yes |
| CVE-2026-20896 | 2.8% | 86.2% | Critical | No |
| CVE-2026-27771 | 1.4% | 72.3% | High | No |
| CVE-2026-27775 | 0.9% | 59.8% | High | No |
| CVE-2019-1010314 | 0.8% | 58% | Not scored | No |
| CVE-2019-1010261 | 0.8% | 57.7% | Not scored | No |
| CVE-2026-56654 | 0.8% | 57.4% | Critical | No |
| CVE-2026-26292 | 0.7% | 51.1% | Critical | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.