Gogs vulnerabilities

Products

• Gogs 75
• Gogs/gogs 10

Newest

• gogs Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` CVE-2026-82402 5.3 MediumOctober 14, 2026
• gogs Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity CVE-2026-52795 4.3 MediumJune 24, 2026
• gogs Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS CVE-2026-52816 Fix available 5.4 MediumJune 23, 2026
• gogs Gogs: Unauthenticated Organization Teams Information Disclosure via API CVE-2026-52815 Fix available 5.5 MediumJune 23, 2026
• gogs Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) CVE-2026-52814 Fix available 5.5 MediumJune 23, 2026
• gogs Gogs: Path Traversal in organization name results in RCE through Git hooks CVE-2026-52813 Public exploitFix available 10.0 CriticalJune 23, 2026
• gogs Gogs: LFS dedupe path leaks private repo content across tenants CVE-2026-52812 Fix available 7.1 HighJune 23, 2026
• gogs Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym CVE-2026-52811 Fix available 9.0 CriticalJune 23, 2026
• gogs Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion CVE-2026-52810 Public exploitFix available 7.1 HighJune 23, 2026
• gogs Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES CVE-2026-52809 Fix available 6.8 MediumJune 23, 2026
• gogs Gogs: Write-level collaborators can mutate admin-only repository settings via API CVE-2026-52808 Fix available 7.1 HighJune 23, 2026
• gogs Gogs: DOM-based XSS via Milestone Name on New Issue Page CVE-2026-52807 Fix available 4.8 MediumJune 23, 2026
• gogs Gogs: RCE via git rebase --exec argument injection in pull request merge CVE-2026-52806 Public exploitFix available 9.9 CriticalJune 23, 2026
• gogs Gogs: Migration Redirect Bypass Leads to Internal Repository Theft CVE-2026-52805 Fix available 8.7 HighJune 23, 2026
• gogs Gogs: Privilege Escalation via Collaboration Access Mode Validation CVE-2026-52804 Fix available 5.5 MediumJune 23, 2026
• gogs Gogs: Open Redirect via redirect_to in Gogs CVE-2026-52802 Fix available 5.4 MediumJune 23, 2026
• gogs Gogs: Ability to import local repositories via Mirror Settings CVE-2026-52801 Fix available 8.1 HighJune 23, 2026
• gogs Gogs: CSRF Leading to Organization Owner Takeover CVE-2026-52800 Fix available 8.8 HighJune 23, 2026
• gogs Gogs: Missing Authorization in Attachment Download CVE-2026-52799 Fix available 7.5 HighJune 22, 2026
• gogs Gogs: Stored XSS in `.ipynb` Preview CVE-2026-52798 Fix available 8.9 HighJune 22, 2026
• gogs Gogs: DoS in rendering issue index pattern CVE-2026-52796 Fix available 3.5 LowJune 22, 2026
• gogs Gogs: SSRF in webhook deliveries CVE-2026-47267 Fix available 8.3 HighJune 22, 2026
• gogs Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers CVE-2026-25119 Fix available 7.7 HighJune 22, 2026
• gogs Gogs: Denial of Service in repository/wiki file listing web pages CVE-2025-64719 Fix available 4.9 MediumJune 22, 2026
• gogs Gogs: Overwriting critical files results in a denial of service CVE-2026-52797 Fix available 8.5 HighJune 16, 2026
• gogs Gogs: DOM-based XSS via milestone selection CVE-2026-26276 Fix available 7.3 HighMarch 5, 2026
• gogs Gogs: Access tokens get exposed through URL params in API requests CVE-2026-26196 Fix available 6.9 MediumMarch 5, 2026
• gogs Gogs: Stored XSS in branch and wiki views through author and committer names CVE-2026-26195 Fix available 6.9 MediumMarch 5, 2026
• gogs Gogs: Release tag option injection in release deletion CVE-2026-26194 Fix available 8.8 HighMarch 5, 2026
• gogs Gogs: Cross-repository LFS object overwrite via missing content hash verification CVE-2026-25921 Fix available 9.3 CriticalMarch 5, 2026
• gogs Gogs: Stored XSS via data URI in issue comments CVE-2026-26022 Fix available 8.7 HighMarch 5, 2026
• gogs Gogs allows unauthenticated file uploads CVE-2026-25242 Fix available 6.9 MediumFebruary 17, 2026
• gogs Gogs has a Protected Branch Deletion Bypass in Web Interface CVE-2026-25232 Public exploitFix available 7.1 HighFebruary 17, 2026
• gogs Gogs Authorization Bypass Allows Cross-Repository Label Modification CVE-2026-25229 Fix available 5.3 MediumFebruary 17, 2026
• gogs Gogs Allows Cross-Repository Comment Deletion via DeleteComment CVE-2026-25120 Fix available 5.1 MediumFebruary 17, 2026
• gogs Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update CVE-2026-24135 Public exploitFix available 7.2 HighFebruary 6, 2026
• gogs Gogs has arbitrary file read/write via path traversal in Git hook editing CVE-2026-23633 Fix available 6.5 MediumFebruary 6, 2026
• gogs Gogs user can update repository content with read-only permission CVE-2026-23632 Fix available 6.5 MediumFebruary 6, 2026
• gogs Gogs is Vulnerable to Denial of Service CVE-2026-22592 Fix available 6.5 MediumFebruary 6, 2026
• gogs Gogs Vulnerable to 2FA Bypass via Recovery Code CVE-2025-64175 Fix available 7.7 HighFebruary 6, 2026
• gogs Gogs's update .git/config file allows remote command execution CVE-2025-64111 Fix available 9.3 CriticalFebruary 6, 2026
• gogs File overwrite in file update API in Gogs CVE-2025-8110 In KEVPublic exploitFix available EPSS 85.2% 8.7 HighDecember 10, 2025
• gogs Gogs stored XSS in PDF renderer CVE-2025-47943 Fix available 6.3 MediumJune 24, 2025
• gogs Gogs deletion of internal files allows remote command execution CVE-2024-56731 Fix available 10.0 CriticalJune 24, 2025
• gogs Gogs has a Path Traversal in file update API CVE-2024-55947 Public exploitFix available EPSS 77.8% 8.7 HighDecember 23, 2024
• gogs Gogs has a Path Traversal in file editing UI CVE-2024-54148 Fix available 8.7 HighDecember 23, 2024
• gogs Remote Code Execution in Gogs CVE-2024-44625 Public exploitFix available EPSS 16.5% 8.8 HighNovember 15, 2024
• gogs Duplicate Advisory: Gogs allows argument injection during the tagging of a new release CVE-2024-39933 Fix available 7.7 HighJuly 4, 2024
• gogs Gogs allows argument injection during the previewing of changes CVE-2024-39932 Fix available EPSS 16.3% 9.9 CriticalJuly 4, 2024
• gogs Duplicate Advisory: Gogs allows deletion of internal files CVE-2024-39931 Fix available EPSS 52.7% 9.9 CriticalJuly 4, 2024
• Show olderLoading…