GGogs

Products

Exploited and recent CVEs

• CVE-2025-8110 High 8.7 Exploited File overwrite in file update API in Gogs 85.2%
• CVE-2026-123012 High 7.1 In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs becau 0.3%
• CVE-2026-82402 Medium 5.3 Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` 0.4%
• CVE-2026-52797 High 8.5 Gogs: Overwriting critical files results in a denial of service 0.5%
• CVE-2026-52813 Critical 10.0 Gogs: Path Traversal in organization name results in RCE through Git hooks 1.1%
• CVE-2026-52812 High 7.1 Gogs: LFS dedupe path leaks private repo content across tenants 0.2%
• CVE-2026-52811 Critical 9.0 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym 0.5%
• CVE-2026-52810 High 7.1 Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion 0.4%
• CVE-2026-52809 Medium 6.8 Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES 0.2%
• CVE-2026-52808 High 7.1 Gogs: Write-level collaborators can mutate admin-only repository settings via API 0.5%
• CVE-2026-52816 Medium 5.4 Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS 0.7%
• CVE-2026-52807 Medium 4.8 Gogs: DOM-based XSS via Milestone Name on New Issue Page 0.5%
• CVE-2026-52805 High 8.7 Gogs: Migration Redirect Bypass Leads to Internal Repository Theft 0.4%
• CVE-2026-52806 Critical 9.9 Gogs: RCE via git rebase --exec argument injection in pull request merge 7.9%
• CVE-2026-52804 Medium 5.5 Gogs: Privilege Escalation via Collaboration Access Mode Validation 0.5%
• CVE-2026-52799 High 7.5 Gogs: Missing Authorization in Attachment Download 0.4%
• CVE-2026-52801 High 8.1 Gogs: Ability to import local repositories via Mirror Settings 0.6%
• CVE-2026-52800 High 8.8 Gogs: CSRF Leading to Organization Owner Takeover 0.2%
• CVE-2026-52802 Medium 5.4 Gogs: Open Redirect via redirect_to in Gogs 0.6%
• CVE-2026-52814 Medium 5.5 Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) 0.5%
• CVE-2026-52798 High 8.9 Gogs: Stored XSS in `.ipynb` Preview 0.4%
• CVE-2026-52796 Low 3.5 Gogs: DoS in rendering issue index pattern 0.3%
• CVE-2026-47267 High 8.3 Gogs: SSRF in webhook deliveries 0.4%
• CVE-2026-25119 High 7.7 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers 0.9%
• CVE-2026-52795 Medium 4.3 Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity 0.3%
• CVE-2025-64719 Medium 4.9 Gogs: Denial of Service in repository/wiki file listing web pages 0.4%
• CVE-2026-52815 Medium 5.5 Gogs: Unauthenticated Organization Teams Information Disclosure via API 1.5%
• CVE-2026-26276 High 7.3 Gogs: DOM-based XSS via milestone selection 0.2%
• CVE-2026-26196 Medium 6.9 Gogs: Access tokens get exposed through URL params in API requests 0.3%
• CVE-2026-26195 Medium 6.9 Gogs: Stored XSS in branch and wiki views through author and committer names 0.2%