Lucene search
+L

142 matches found

NVD
NVD
added 2026/09/13 4:17 a.m.10 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/13 3:55 a.m.13 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

4.3CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/13 3:55 a.m.13 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/13 3:55 a.m.8 views

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 3:22 p.m.12 views

CVE-2025-68937

CVE-2025-68937 - RCE por Symlink en Plantillas de Gitea/Forgejo Prueba de concepto automatizada para CVE-2025-68937 : salto de directorio mediante el seguimiento de enlaces simbólicos en el procesamiento de repositorios plantilla de Gitea y Forgejo, que conduce a la ejecución remota de código...

9.5CVSS8.2AI score0.00504EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/09/11 8:04 a.m.5 views

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

3.5CVSS0.0015EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/11 3:16 a.m.7 views

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 2:23 a.m.33 views

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 2:23 a.m.8 views

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 2:23 a.m.24 views

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...

3.5CVSS0.0015EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.11 views

PT-2026-89744

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 11:20 p.m.6 views

Gitea-Forgejo-CVE-2025-68937

Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...

9.5CVSS8.1AI score0.00504EPSS
SaveExploits1
CVE
CVE
added 2026/09/10 8:42 p.m.42 views

CVE-2026-89094

Forgejo versions prior to 16.0.4 are vulnerable to remote code execution (RCE) when a user creates a crafted template repository. The root cause is mishandled template expansion on files located in the .forgejo/template directory, which allows an attacker with low privileges to achieve code execu...

9.9CVSS0.005EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 8:42 p.m.25 views

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 8:42 p.m.7 views

EUVD-2026-75732

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/10 1:09 p.m.4 views

research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho's Knowledge Research On 2025-12-22, a security vulnerability CVE 2025-68971 CVSS: 5.5/MEDIUM was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all...

6.5CVSS6AI score0.00471EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.10 views

PT-2026-89589

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/08 8:59 p.m.13 views

CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution Overview CVE-2026-60004 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versio...

9.8CVSS8.5AI score0.86777EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/08 8:05 p.m.6 views

CVE-2024-45337

Exploit de prueba de concepto para CVE-2024-45337 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-45337. Se puede utilizar para envolver ssh al interactuar con un servidor SSH implementado con golang.org/x/crypto = v0.30.0., mientras se almacenan en caché los permisos en ...

9.1CVSS7.5AI score0.03153EPSS
SaveExploits2
RedhatCVE
RedhatCVE
added 2026/09/01 10:37 a.m.10 views

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...

6.5CVSS6.7AI score0.00214EPSS
SaveExploits0References10
Rows per page
Query Builder