Vulnerabilidades em gogs

59 resultados
Análise Vexday

O Gogs acumula 56 CVEs catalogadas, com 12 classificadas como críticas e 24 surgidas apenas nos últimos 90 dias, o que indica um ritmo recente de descobertas que merece atenção contínua. Embora nenhuma CVE esteja confirmada no catálogo CISA KEV — taxa abaixo da média geral do catálogo —, o CVE-2022-2024 apresenta EPSS de 0.9784, sinalizando altíssima probabilidade de exploração segundo os modelos preditivos, o que representa risco concreto independentemente da ausência de registro KEV. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão recorrente em plataformas de hospedagem de código que expõe usuários a ataques de injeção de conteúdo. Equipes que operam instâncias autossuficientes do Gogs devem priorizar a remediação das vulnerabilidades críticas e monitorar ativamente o CVE-2022-2024 dado seu perfil de risco elevado.

CVE-2026-52799HIGHGogs: Missing Authorization in Attachment DownloadEPSS 0.4%CVE-2026-47267HIGHGogs: SSRF in webhook deliveriesEPSS 0.4%CVE-2025-47943MEDIUMGogs stored XSS in PDF rendererEPSS 0.4%CVE-2026-52805HIGHGogs: Migration Redirect Bypass Leads to Internal Repository TheftEPSS 0.4%CVE-2026-22592MEDIUMGogs is Vulnerable to Denial of ServiceEPSS 0.4%CVE-2026-25921CRITICALGogs: Cross-repository LFS object overwrite via missing content hash verificationEPSS 0.4%CVE-2026-26022HIGHGogs: Stored XSS via data URI in issue commentsEPSS 0.4%CVE-2026-123012HIGHIn Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a diEPSS 0.3%CVE-2026-23632MEDIUMGogs user can update repository content with read-only permissionEPSS 0.3%CVE-2026-25120MEDIUMGogs Allows Cross-Repository Comment Deletion via DeleteCommentEPSS 0.3%CVE-2026-25229MEDIUMGogs Authorization Bypass Allows Cross-Repository Label ModificationEPSS 0.3%CVE-2026-26196MEDIUMGogs: Access tokens get exposed through URL params in API requestsEPSS 0.3%CVE-2026-52796LOWGogs: DoS in rendering issue index patternEPSS 0.3%CVE-2026-52795MEDIUMGogs: Authorization Bypass in Watch API allows any user to monitor private repository activityEPSS 0.3%CVE-2026-52800HIGHGogs: CSRF Leading to Organization Owner TakeoverEPSS 0.2%CVE-2026-52812HIGHGogs: LFS dedupe path leaks private repo content across tenantsEPSS 0.2%CVE-2026-26195MEDIUMGogs: Stored XSS in branch and wiki views through author and committer namesEPSS 0.2%CVE-2026-26276HIGHGogs: DOM-based XSS via milestone selectionEPSS 0.2%CVE-2026-52809MEDIUMGogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESEPSS 0.2%