Затронутые ветки версий
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-119547 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 5.3 | — | 2026-10-30 | |
| CVE-2026-119546 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 6.8 | — | 2026-10-30 | |
| CVE-2026-119545 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery | ≤ 15.0.11 ≥ 16.0.0 ≤ 16.0.7 ≥ 17.0.0 ≤ 17.0.1 | 6.9 | — | 2026-10-30 | |
| CVE-2026-90679 | Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects id... | ≥ 13.0.0 ≤ 16.0.4 | 4.3 | — | 2026-09-13 | |
| CVE-2026-59102 | Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering | < 15.0.3 | 2.1 | — | 2026-07-03 | |
| CVE-2025-68971 | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte f... | * | 6.5 | — | 2026-03-16 | |
| CVE-2023-49946 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which... | * | — | — | 2023-12-03 | |
| CVE-2023-49947 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. | * | — | — | 2023-12-03 | |
| CVE-2023-49948 | Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appendin... | * | — | — | 2023-12-03 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).