Corrigé dans
CVE affectant 0.12
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2025-8110 | File overwrite in file update API in Gogs | 8.7 | KEV | 80.3% | 2025-12-10 |
| CVE-2024-39930 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to re... | 9.9 | — | 2024-07-04 | |
| CVE-2024-39931 | Gogs through 0.13.0 allows deletion of internal files. | 9.9 | — | 2024-07-04 | |
| CVE-2024-39932 | Gogs through 0.13.0 allows argument injection during the previewing of changes. | 9.9 | — | 2024-07-04 | |
| CVE-2022-1884 | Remote Command Execution in gogs/gogs | 9.8 | — | 2024-11-15 | |
| CVE-2024-56731 | Gogs deletion of internal files allows remote command execution | 9.8 | — | 2025-06-24 | |
| CVE-2022-1986 | OS Command Injection in gogs/gogs | 9.8 | — | 2022-06-09 | |
| CVE-2022-2024 | OS Command Injection in gogs/gogs | 9.8 | — | 2023-02-25 | |
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verification | 9.3 | — | 2026-03-05 | |
| CVE-2025-64111 | Gogs's update .git/config file allows remote command execution | 9.3 | — | 2026-02-06 | |
| CVE-2022-1992 | Path Traversal in gogs/gogs | 9.1 | — | 2022-06-09 | |
| CVE-2022-0871 | Missing Authorization in gogs/gogs | 9.1 | — | 2022-03-11 | |
| CVE-2022-32174 | Gogs - XSS | 9.0 | — | 2022-10-11 | |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletion | 8.8 | — | 2026-03-05 | |
| CVE-2024-44625 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor... | 8.8 | — | 2024-11-15 | |
| CVE-2022-0415 | Remote Command Execution in uploading repository file in gogs/gogs | 8.8 | — | 2022-03-21 | |
| CVE-2021-32546 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute cod... | 8.8 | — | 2022-06-02 | |
| CVE-2024-55947 | Gogs has a Path Traversal in file update API | 8.7 | — | 2024-12-23 | |
| CVE-2024-54148 | Gogs has a Path Traversal in file editing UI | 8.7 | — | 2024-12-23 | |
| CVE-2022-1993 | Path Traversal in gogs/gogs | 8.1 | — | 2022-06-09 | |
| CVE-2025-64175 | Gogs Vulnerable to 2FA Bypass via Recovery Code | 7.7 | — | 2026-02-06 | |
| CVE-2024-39933 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. | 7.7 | — | 2024-07-04 | |
| CVE-2026-24135 | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update | 7.2 | — | 2026-02-06 | |
| CVE-2020-15867 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be... | 7.2 | — | 2020-10-16 | |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interface | 7.1 | — | 2026-02-19 | |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requests | 6.9 | — | 2026-03-05 | |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer names | 6.9 | — | 2026-03-05 | |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads | 6.9 | — | 2026-02-19 | |
| CVE-2026-23632 | Gogs user can update repository content with read-only permission | 6.5 | — | 2026-02-06 | |
| CVE-2026-22592 | Gogs is Vulnerable to Denial of Service | 6.5 | — | 2026-02-06 | |
| CVE-2022-1285 | Server-Side Request Forgery (SSRF) in gogs/gogs | 6.5 | — | 2022-06-01 | |
| CVE-2026-23633 | Gogs has arbitrary file read/write via path traversal in Git hook editing | 6.5 | — | 2026-02-06 | |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selection | 5.4 | — | 2026-03-05 | |
| CVE-2022-31038 | XSS vulnerability in repository issue list in Gogs | 5.4 | — | 2022-06-09 | |
| CVE-2022-1464 | Stored xss bug in gogs/gogs | 5.4 | — | 2022-05-05 | |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue comments | 5.4 | — | 2026-03-05 | |
| CVE-2022-0870 | Server-Side Request Forgery (SSRF) in gogs/gogs | 5.3 | — | 2022-03-11 | |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modification | 5.3 | — | 2026-02-19 | |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment | 5.1 | — | 2026-02-19 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).