Vulnerabilidades em gogs

57 resultados
Análise Vexday

O Gogs acumula 56 CVEs catalogadas, com 12 classificadas como críticas e 24 surgidas apenas nos últimos 90 dias, o que indica um ritmo recente de descobertas que merece atenção contínua. Embora nenhuma CVE esteja confirmada no catálogo CISA KEV — taxa abaixo da média geral do catálogo —, o CVE-2022-2024 apresenta EPSS de 0.9784, sinalizando altíssima probabilidade de exploração segundo os modelos preditivos, o que representa risco concreto independentemente da ausência de registro KEV. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em plataformas de hospedagem de código que expõe usuários a ataques de injeção de conteúdo. Equipes que operam instâncias autossuficientes do Gogs devem priorizar a remediação das vulnerabilidades críticas e monitorar ativamente o CVE-2022-2024 dado seu perfil de risco elevado.

CVE-2022-1464HIGHStored xss bug in gogs/gogsEPSS 0.7%CVE-2022-31038MEDIUMXSS vulnerability in repository issue list in GogsEPSS 0.7%CVE-2026-52816MEDIUMGogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSEPSS 0.7%CVE-2026-25242MEDIUMGogs allows unauthenticated file uploadsEPSS 0.6%CVE-2026-52801HIGHGogs: Ability to import local repositories via Mirror SettingsEPSS 0.6%CVE-2026-52802MEDIUMGogs: Open Redirect via redirect_to in GogsEPSS 0.6%CVE-2026-52814MEDIUMGogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)EPSS 0.5%CVE-2026-52797HIGHGogs: Overwriting critical files results in a denial of serviceEPSS 0.5%CVE-2026-26194HIGHGogs: Release tag option injection in release deletionEPSS 0.5%CVE-2026-52804MEDIUMGogs: Privilege Escalation via Collaboration Access Mode ValidationEPSS 0.5%CVE-2026-52807MEDIUMGogs: DOM-based XSS via Milestone Name on New Issue PageEPSS 0.5%CVE-2026-52808HIGHGogs: Write-level collaborators can mutate admin-only repository settings via APIEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2026-23633MEDIUMGogs has arbitrary file read/write via path traversal in Git hook editingEPSS 0.5%CVE-2026-25232HIGHGogs has a Protected Branch Deletion Bypass in Web InterfaceEPSS 0.4%CVE-2025-64719MEDIUMGogs: Denial of Service in repository/wiki file listing web pagesEPSS 0.4%CVE-2025-64175HIGHGogs Vulnerable to 2FA Bypass via Recovery CodeEPSS 0.4%CVE-2026-52798HIGHGogs: Stored XSS in `.ipynb` PreviewEPSS 0.4%CVE-2026-52810HIGHGogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusionEPSS 0.4%CVE-2026-52799HIGHGogs: Missing Authorization in Attachment DownloadEPSS 0.4%