GO
Product
gogs
On CISA KEVExploited in the wild
74
CVEs
1
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 19High 27Medium 26Low 2
Watch
Add gogs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-52809 | 6.8 | Jun 24 | Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES Affected: < 0.14.3 |
| CVE-2026-25229 | 6.5 | Feb 19 | Gogs Authorization Bypass Allows Cross-Repository Label Modification Affected: < 0.14.1 |
| CVE-2026-23633 | 6.5 | Feb 6 | Gogs has arbitrary file read/write via path traversal in Git hook editing Affected: < 0.14.0+dev; < 0.13.4 |
| CVE-2026-23632 | 6.5 | Feb 6 | Gogs user can update repository content with read-only permission Affected: < 0.14.0+dev; < 0.13.4 |
| CVE-2026-22592 | 6.5 | Feb 6 | Gogs is Vulnerable to Denial of Service Affected: < 0.14.0+dev; < 0.13.4 |
| CVE-2022-1285 | 6.5 | Jun 1 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8 Affected: before 0.12.8 |
| CVE-2020-14958 | 6.5 | Jun 21 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check Affected: 0.11.91 |
| CVE-2026-26195 | 6.1 | Mar 5 | Gogs: Stored XSS in branch and wiki views through author and committer names Affected: < 0.14.2 |
| CVE-2018-17031 | 6.1 | Sep 14 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an… Affected: 0.11.53 |
| CVE-2018-15178 | 6.1 | Aug 8 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the… Affected: before 0.12 |
| CVE-2020-9329 | 5.9 | Feb 21 | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition Affected: through 0.11.91 |
| CVE-2026-52804 | 5.5 | Jun 24 | Gogs: Privilege Escalation via Collaboration Access Mode Validation Affected: < 0.14.3 |
| CVE-2026-52814 | 5.5 | Jun 24 | Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) Affected: < 0.14.3 |
| CVE-2026-52815 | 5.5 | Jun 24 | Gogs: Unauthenticated Organization Teams Information Disclosure via API Affected: < 0.14.3 |
| CVE-2026-52816 | 5.4 | Jun 24 | Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS Affected: < 0.14.3 |
| CVE-2026-52802 | 5.4 | Jun 24 | Gogs: Open Redirect via redirect_to in Gogs Affected: < 0.14.3 |
| CVE-2026-26276 | 5.4 | Mar 5 | Gogs: DOM-based XSS via milestone selection Affected: < 0.14.2 |
| CVE-2026-26022 | 5.4 | Mar 5 | Gogs: Stored XSS via data URI in issue comments Affected: < 0.14.2 |
| CVE-2022-31038 | 5.4 | Jun 9 | Gogs is an open source self-hosted Git service Affected: before 0.12.9 |
| CVE-2022-1464 | 5.4 | May 5 | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7 Affected: before 0.12.7 |
| CVE-2026-82402 | 5.3 | Oct 14 | Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` Affected: < 0.15.0+dev |
| CVE-2026-26196 | 5.3 | Mar 5 | Gogs: Access tokens get exposed through URL params in API requests Affected: < 0.14.2 |
| CVE-2022-0870 | 5.3 | Mar 11 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5 Affected: before 0.12.5 |
| CVE-2025-64719 | 4.9 | Jun 24 | Gogs: Denial of Service in repository/wiki file listing web pages Affected: < 0.14.3 |
| CVE-2026-52807 | 4.8 | Jun 24 | Gogs: DOM-based XSS via Milestone Name on New Issue Page Affected: < 0.14.3 |
| CVE-2026-52795 | 4.3 | Jun 24 | Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity Affected: <= 0.14.3 |
Showing 26