Known vulnerabilities in gogs

Vendor: gogs.io
Software: gogs
Software CPE: cpe:2.3:a:gogs.io:gogs:*:*:*:*:*:*:*:*
Total vulnerabilities: 71
Public exploits: 7
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting gogs gogs is affected by 71 known vulnerabilities: 12 high, 30 medium, 29 low Critical High Medium Low

Vulnerabilities (71)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134915 - Improper input validation
CVE-2026-52796
CWE-20 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134912 - Authentication Bypass by Spoofing
CVE-2026-25119
CWE-290 High
No
No
0.14.3 19.06.2026 SB2026061904
#VU134911 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-52798
CWE-79 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134910 - Authorization Bypass Through User-Controlled Key
CVE-2026-52799
CWE-639 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134909 - Cross-Site Request Forgery (CSRF)
CVE-2026-52800
CWE-352 High
No
No
0.14.3 19.06.2026 SB2026061904
#VU134908 - Improper input validation
CVE-2026-52801
CWE-20 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134907 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-52802
CWE-601 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134906 - Off-by-one Error
CVE-2026-52804
CWE-193 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134904 - Command injection
CVE-2026-52806
CWE-77 Medium
Available
No
0.14.3 19.06.2026 SB2026061904
#VU134903 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-52807
CWE-79 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134902 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2026-52816
CWE-80 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134901 - Incorrect Authorization
CVE-2026-52808
CWE-863 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134900 - Insufficient Session Expiration
CVE-2026-52809
CWE-613 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134899 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-80 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134898 - Improper Access Control
CVE-2026-52810
CWE-284 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134897 - Improper Link Resolution Before File Access ('Link Following')
CVE-2026-52811
CWE-59 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134896 - Insufficient Verification of Data Authenticity
CVE-2026-52812
CWE-345 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134895 - Relative Path Traversal
CVE-2026-52813
CWE-23 High
No
No
0.14.3 19.06.2026 SB2026061904
#VU134894 - Resource exhaustion
CVE-2026-52814
CWE-400 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU134893 - Exposure of sensitive information to an unauthorized actor
CVE-2026-52815
CWE-200 Medium
No
No
0.14.3 19.06.2026 SB2026061904


Showing elements 1 - 20 out of 71