Исправлено в
CVE, затрагивающие 0.14
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verification | 9.3 | — | 2026-03-05 | |
| CVE-2022-32174 | Gogs - XSS | 9.0 | — | 2022-10-11 | |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletion | 8.8 | — | 2026-03-05 | |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interface | 7.1 | — | 2026-02-19 | |
| CVE-2026-123012 | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only... | 7.1 | — | 2026-11-05 | |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requests | 6.9 | — | 2026-03-05 | |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer names | 6.9 | — | 2026-03-05 | |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads | 6.9 | — | 2026-02-19 | |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selection | 5.4 | — | 2026-03-05 | |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue comments | 5.4 | — | 2026-03-05 | |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modification | 5.3 | — | 2026-02-19 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).