影響を受けるバージョン系列
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-119547 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 5.3 | — | 2026-10-30 | |
| CVE-2026-119546 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 6.8 | — | 2026-10-30 | |
| CVE-2026-119545 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 6.9 | — | 2026-10-30 | |
| CVE-2026-90679 | Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects id... | ≥ 13.0.0 ≤ 16.0.4 | 4.3 | — | 2026-09-13 | |
| CVE-2026-59102 | Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering | < 15.0.3 | 2.1 | — | 2026-07-03 | |
| CVE-2025-68971 | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte f... | * | 6.5 | — | 2026-03-16 | |
| CVE-2023-49946 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which... | * | — | — | 2023-12-03 | |
| CVE-2023-49947 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. | * | — | — | 2023-12-03 | |
| CVE-2023-49948 | Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appendin... | * | — | — | 2023-12-03 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。