products / gitea
Gitea
Gitea is a lightweight, self-hosted Git platform written in Go. NVD tracks the application as gitea:gitea with a solid historical CVE record for authentication and repository edge cases.
api usage
Querying Gitea
product slug
giteaversion format
1.16.2, 1.21.0bash
curl "https://api.attestd.io/v1/check?product=gitea&version=1.16.2" \
-H "Authorization: Bearer $ATTESTD_KEY"Example line with multiple XSS and authorization issues from the 1.16.x era. Exact risk_state depends on NVD range aggregation for your semver.
json
{
"product": "gitea",
"version": "1.16.2",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": null,
"confidence": 0.5,
"cve_ids": [
"CVE-2022-0905",
"CVE-2022-1058",
"CVE-2022-1928",
"CVE-2022-30781",
"CVE-2022-38183",
"CVE-2022-38795",
"CVE-2022-42968",
"CVE-2023-3515",
"CVE-2025-68938",
"CVE-2025-68939",
"CVE-2025-68940",
"CVE-2025-68941",
"CVE-2025-68942",
"CVE-2025-68943",
"CVE-2025-68944",
"CVE-2025-68945",
"CVE-2025-68946",
"CVE-2025-69413",
"CVE-2026-0798",
"CVE-2026-20736",
"CVE-2026-20750",
"CVE-2026-20800",
"CVE-2026-20883",
"CVE-2026-20888",
"CVE-2026-20896",
"CVE-2026-20897",
"CVE-2026-20904",
"CVE-2026-20912",
"CVE-2026-23603",
"CVE-2026-24059",
"CVE-2026-27771",
"CVE-2026-34966",
"CVE-2026-42931",
"CVE-2026-50105",
"CVE-2026-54481",
"CVE-2026-55984",
"CVE-2026-55986",
"CVE-2026-55987",
"CVE-2026-56443",
"CVE-2026-56654",
"CVE-2026-56657",
"CVE-2026-56750",
"CVE-2026-56755",
"CVE-2026-57886",
"CVE-2026-57897",
"CVE-2026-58314",
"CVE-2026-58416",
"CVE-2026-58427",
"CVE-2026-58429",
"CVE-2026-58432",
"CVE-2026-58433",
"CVE-2026-58438",
"CVE-2026-58439",
"CVE-2026-58440",
"CVE-2026-58441",
"CVE-2026-58442",
"CVE-2026-58443",
"CVE-2026-58510",
"CVE-2026-58511",
"CVE-2026-59763",
"CVE-2026-59765"
],
"cves": null,
"max_epss": 0.8793,
"last_updated": "2026-08-15T02:40:07.768181Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}newer line
1.22.3 is a representative newer release for a spot check after patches.
bash
curl "https://api.attestd.io/v1/check?product=gitea&version=1.26.3" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2022-27313 | Open redirect via repository migration. | see NVD / 1.16.x era | 7.5 |
CVE-2022-30781 | Session fixation / cookie scope issue. | see NVD | 8.1 |
CVE-2018-18926 | Remote code execution (historical, pre-1.5.4). | pre-1.5.4 | 9.8 |
related