Lucene search
+L

142 matches found

NVD
NVD
added 2026/09/13 4:17 a.m.10 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/13 3:55 a.m.13 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

4.3CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/13 3:55 a.m.13 views

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/13 3:55 a.m.8 views

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

4.3CVSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/11 3:22 p.m.12 views

CVE-2025-68937

CVE-2025-68937 - RCE por Symlink en Plantillas de Gitea/Forgejo Prueba de concepto automatizada para CVE-2025-68937 : salto de directorio mediante el seguimiento de enlaces simbólicos en el procesamiento de repositorios plantilla de Gitea y Forgejo, que conduce a la ejecución remota de código...

9.5CVSS8.2AI score0.00504EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/09/11 8:04 a.m.5 views

CVE-2026-89151

A flaw was found in Forgejo. A remote attacker with low privileges could exploit this vulnerability by using restricted API tokens. This allows for unintended access to the "allow maintainer edit" feature, potentially leading to unauthorized modifications. Mitigation Mitigation for this issue is...

3.5CVSS0.0015EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/11 3:16 a.m.7 views

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/11 2:23 a.m.33 views

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 2:23 a.m.8 views

EUVD-2026-75922

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 2:23 a.m.24 views

CVE-2026-89151

Forgejo before 16.0.4 is affected by a vulnerability allowing restricted API tokens to be used for unintended access to the "allow maintainer edit" feature. The CVSS 3.1 score is 3.5 (LOW) , with a vector of AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N, indicating a network attack requiring low privileges...

3.5CVSS0.0015EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.11 views

PT-2026-89744

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

3.5CVSS0.0015EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/10 11:20 p.m.6 views

Gitea-Forgejo-CVE-2025-68937

Vulnerabilidad de expansión arbitraria de plantillas en Gitea y Forgejo Este trabajo está licenciado bajo una Licencia Creative Commons Atribución-CompartirIgual 4.0 Internacional. Resumen Al revisar el código fuente de Forgejo y Gitea para entender mejor cómo se realiza el templating, descubrí u...

9.5CVSS8.1AI score0.00504EPSS
SaveExploits1
CVE
CVE
added 2026/09/10 8:42 p.m.41 views

CVE-2026-89094

Forgejo versions prior to 16.0.4 are vulnerable to remote code execution (RCE) when a user creates a crafted template repository. The root cause is mishandled template expansion on files located in the .forgejo/template directory, which allows an attacker with low privileges to achieve code execu...

9.9CVSS0.005EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/10 8:42 p.m.25 views

CVE-2026-89094

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 8:42 p.m.7 views

EUVD-2026-75732

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/10 1:09 p.m.4 views

research-cve-2025-68971

CVE 2025-68971 | Investigación de Conocimiento de Holloway Chew, Kean Ho El 22 de diciembre de 2025, se descubrió una vulnerabilidad de seguridad CVE 2025-68971 CVSS: 5.5/MEDIUM en la aplicación de código abierto Forgejo 13.0.3, detectada por primera vez en el sistema operativo FreeBSD14. Provocó...

6.5CVSS6AI score0.00471EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/09/10 12:00 a.m.10 views

PT-2026-89589

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

9.9CVSS0.005EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/08 8:59 p.m.13 views

CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution Overview CVE-2026-60004 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versio...

9.8CVSS8.5AI score0.86777EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/08 8:05 p.m.6 views

CVE-2024-45337

Exploit de prueba de concepto para CVE-2024-45337 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-45337. Se puede utilizar para envolver ssh al interactuar con un servidor SSH implementado con golang.org/x/crypto = v0.30.0., mientras se almacenan en caché los permisos en ...

9.1CVSS7.5AI score0.03153EPSS
SaveExploits2
RedhatCVE
RedhatCVE
added 2026/09/01 10:37 a.m.10 views

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...

6.5CVSS6.7AI score0.00214EPSS
SaveExploits0References10
Rows per page
Query Builder