GO-2026-4454 Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs

Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...

GO-2026-4449 Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs

Gogs Vulnerable to 2FA Bypass via Recovery Code in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...

GO-2026-4457 Gogs has authorization bypass in repository deletion API in gogs.io/gogs

Gogs has authorization bypass in repository deletion API in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-4451 Gogs has a Denial of Service issue in gogs.io/gogs

Gogs has a Denial of Service issue in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...

GO-2026-4450 Gogs user can update repository content with read-only permission in gogs.io/gogs

Gogs user can update repository content with read-only permission in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2026-4448 Gogs's update .git/config file allows remote command execution in gogs.io/gogs

Gogs's update .git/config file allows remote command execution in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...

PT-2026-20321

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.4 and below Description Gogs, a self-hosted Git service, has a broken access control issue. Authenticated users with write access to a repository can modify labels belonging to other repositories. This is due to a failure in...

PT-2026-20322

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.4 and below Description Gogs, an open-source self-hosted Git service, contains an access control bypass issue. Repository collaborators with Write permissions can delete protected branches, including the default branch, by...

CVE-2026-25229

creationtimestamp| type| source ---|---|--- 2026-02-14 21:23:34+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh...

PT-2026-20323

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.1 Gogs versions 0.13.4 and below Description Gogs, an open-source self-hosted Git service, allows unauthenticated file uploads by default. When the RequireSigninView setting is disabled which is the default...

PT-2026-23486

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description Gogs, a self-hosted Git service, contains a stored cross-site scripting XSS issue due to unsafe template rendering. The issue arises from mixing user input with permissive sanitizer handling of data UR...

PT-2026-23487

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description The Gogs API accepts tokens in URL parameters, specifically token and access token. This can lead to information disclosure as these tokens may be logged, stored in browser history, or sent in referrer...

PT-2026-23485

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description A security issue exists in Gogs, an open source self-hosted Git service, where deleting a release can fail if a user-controlled tag name is passed to Git without the proper separator. This allows for G...

PT-2026-36247

Уязвимость программного средства создания самоуправляемых Git-репозиториев Gogs связана с внедрением или модификацией аргументов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность и доступность защищаемой информации...

PT-2026-36243

Уязвимость функции safe программного средства создания самоуправляемых Git-репозиториев Gogs существует из-за непринятия мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить межсайтовые сценарные атаки...

PT-2026-36244

Уязвимость реализации прикладного программного интерфейса программного средства создания самоуправляемых Git-репозиториев Gogs связана с раскрытием информации посредством строки запросов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный досту...

PT-2026-23484

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description Gogs, a self-hosted Git service, contains a stored cross-site scripting XSS issue in the comment and issue description functionality. The HTML sanitizer allows data: URI schemes, enabling authenticated...

PT-2026-36246

Уязвимость программного средства создания самоуправляемых Git-репозиториев Gogs существует из-за непринятия мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить межсайтовые сценарные атаки...

Exploit for Path Traversal in Gogs

Affected Software: Gogs self‑hosted Git service versions pri...

PT-2026-23483

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description Gogs, a self-hosted Git service, has a flaw where Large File Storage LFS objects can be maliciously overwritten across different repositories. This is due to a lack of isolation in how LFS objects are...