Vulnerabilities in Gogs

57 results
Vexday analysis

Gogs apresenta 1 vulnerabilidade catalogada, integralmente sob exploração ativa (KEV), relacionada a traversal de diretório (CWE-22). Embora nenhuma seja crítica por CVSS e sem publicações recentes, a exploração em campo representa risco imediato para ambientes em produção.

CVE-2026-25921CRITICALGogs: Cross-repository LFS object overwrite via missing content hash verificationEPSS 0.3%CVE-2026-47267HIGHGogs: SSRF in webhook deliveriesEPSS 0.3%CVE-2025-47943MEDIUMGogs stored XSS in PDF rendererEPSS 0.3%CVE-2026-26022HIGHGogs: Stored XSS via data URI in issue commentsEPSS 0.3%CVE-2026-52798HIGHGogs: Stored XSS in `.ipynb` PreviewEPSS 0.3%CVE-2026-23632MEDIUMGogs user can update repository content with read-only permissionEPSS 0.3%CVE-2026-52805HIGHGogs: Migration Redirect Bypass Leads to Internal Repository TheftEPSS 0.3%CVE-2026-25120MEDIUMGogs Allows Cross-Repository Comment Deletion via DeleteCommentEPSS 0.3%CVE-2026-26196MEDIUMGogs: Access tokens get exposed through URL params in API requestsEPSS 0.3%CVE-2026-25229MEDIUMGogs Authorization Bypass Allows Cross-Repository Label ModificationEPSS 0.3%CVE-2026-52796LOWGogs: DoS in rendering issue index patternEPSS 0.2%CVE-2026-52812HIGHGogs: LFS dedupe path leaks private repo content across tenantsEPSS 0.2%CVE-2026-52800HIGHGogs: CSRF Leading to Organization Owner TakeoverEPSS 0.2%CVE-2026-26195MEDIUMGogs: Stored XSS in branch and wiki views through author and committer namesEPSS 0.2%CVE-2026-26276HIGHGogs: DOM-based XSS via milestone selectionEPSS 0.2%CVE-2026-52795MEDIUMGogs: Authorization Bypass in Watch API allows any user to monitor private repository activityEPSS 0.2%CVE-2026-52809MEDIUMGogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESEPSS 0.2%