Known vulnerabilities in gogs - page 2

Vendor: gogs.io
Software: gogs
Software CPE: cpe:2.3:a:gogs.io:gogs:*:*:*:*:*:*:*:*
Total vulnerabilities: 71
Public exploits: 7
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting gogs gogs is affected by 71 known vulnerabilities: 12 high, 30 medium, 29 low Critical High Medium Low

Vulnerabilities (71)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134914 - Server-Side Request Forgery (SSRF)
CVE-2026-47267
CWE-918 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134913 - Improper input validation
CVE-2025-64719
CWE-20 Low
No
No
0.14.3 19.06.2026 SB2026061904
#VU134905 - Server-Side Request Forgery (SSRF)
CVE-2026-52805
CWE-918 Medium
No
No
0.14.3 19.06.2026 SB2026061904
#VU133268 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-52797
CWE-22 Medium
No
No
0.14.0 03.06.2026 SB2026020959
#VU132782 - Argument Injection or Modification
CWE-88 Medium
No
No
- 29.05.2026 SB2026052946
#VU129681 - Insufficient Verification of Data Authenticity
CVE-2026-25921
CWE-345 High
Available
No
0.14.2 05.05.2026 SB2026050544
#VU128099 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26022
CWE-79 Low
No
No
0.14.2 27.04.2026 SB2026042780
#VU128098 - Argument Injection or Modification
CVE-2026-26194
CWE-88 Low
No
No
0.14.2 27.04.2026 SB2026042780
#VU128097 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26195
CWE-79 Low
No
No
0.14.2 27.04.2026 SB2026042780
#VU128096 - Information Exposure Through Query Strings in GET Request
CVE-2026-26196
CWE-598 Low
No
No
0.14.2 27.04.2026 SB2026042780
#VU128095 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26276
CWE-79 Low
No
No
0.14.2 27.04.2026 SB2026042780
#VU128094 - Authorization Bypass Through User-Controlled Key
CVE-2026-25120
CWE-639 Low
No
No
0.14.0 27.04.2026 SB2026020959
#VU128093 - Improper Access Control
CVE-2026-25229
CWE-284 Low
No
No
0.14.0 27.04.2026 SB2026020959
#VU128092 - Improper Access Control
CVE-2026-25242
CWE-284 Medium
No
No
0.14.0 27.04.2026 SB2026020959
#VU128091 - Incorrect Authorization
CVE-2026-25232
CWE-863 Medium
No
No
0.14.0 27.04.2026 SB2026020959
#VU128079 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47943
CWE-79 Low
No
No
0.13.3 27.04.2026 SB2026042779
#VU128073 - Improper Link Resolution Before File Access ('Link Following')
CVE-2024-56731
CWE-59 High
No
No
0.13.3 27.04.2026 SB2026042779
#VU122462 - Improper Authentication
CVE-2025-64175
CWE-287 High
No
No
0.13.4, 0.14.0 09.02.2026 SB2026020959
#VU122461 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-64111
CWE-78 High
Available
No
0.13.4, 0.14.0 09.02.2026 SB2026020959
#VU116013 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-54880
CWE-79 Low
No
No
0.13.4 23.09.2025 SB2025092311
SB2025092318
SB2025092319
and 12 more


Showing elements 21 - 40 out of 71