Corrigé dans
CVE affectant 0.14
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verification | 9.3 | — | 2026-03-05 | |
| CVE-2022-32174 | Gogs - XSS | 9.0 | — | 2022-10-11 | |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletion | 8.8 | — | 2026-03-05 | |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interface | 7.1 | — | 2026-02-19 | |
| CVE-2026-123012 | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only... | 7.1 | — | 2026-11-05 | |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requests | 6.9 | — | 2026-03-05 | |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer names | 6.9 | — | 2026-03-05 | |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads | 6.9 | — | 2026-02-19 | |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selection | 5.4 | — | 2026-03-05 | |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue comments | 5.4 | — | 2026-03-05 | |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modification | 5.3 | — | 2026-02-19 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).