Login Request a demo
FO
Product
forgejo
by forgejo · last CVE Sep 13, 2026
9
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 3High 1Medium 4Low 1
Severity
All severities9Critical3High1Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add forgejo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-82556
6.3
0%
Aug 30
Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
Affected: 15.0.0; 15.0.1; 15.0.2; 15.0.3; 15.0.4
CVE-2026-59102
5.4
0%
Jul 2
Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering
Affected: before 15.0.3
CVE-2023-49948
5.3
1%
Dec 3
Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL
Affected: before 1.20.5-1
CVE-2026-90679
4.3
0%
Sep 13
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content…
Affected: 13.0.0 through 16.0.4
Showing 4