| Gogs has DOM-based XSS via Milestone Name on New Issue PageCVE-2026-52807 · GHSA-VCM5-GVMP-78MPVersion ranges need review. |
gogs.io/gogs |
Go |
Medium
|
Fix reported |
|
| Path Traversal in file update API in gogsCVE-2024-55947 · GHSA-QF5V-RP47-55GGVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs XSS allowed by stored call in PDF rendererCVE-2025-47943 · GHSA-XH32-CX6C-CP4VVersion ranges need review. |
github.com/gogs/gogsgogs.io/gogs |
Go |
Medium
|
Fix reported |
|
| Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via APICVE-2026-52815 · GHSA-744X-3838-5R56Version ranges need review. |
gogs.io/gogs |
Go |
Medium
|
Fix reported |
|
| Gogs has Path Traversal in organization name that results in RCE through Git hooksCVE-2026-52813 · GHSA-C39W-43GM-34H5Version ranges need review. |
gogs.io/gogs |
Go |
Critical
|
Fix reported |
|
| Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusionCVE-2026-52810 · GHSA-WMFG-5P4H-5FW3Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs: XSS in .ipynb files renderer due to outdated notebookjsGHSA-6VXV-WG6J-5QWP · GO-2026-5193Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs: LFS dedupe path leaks private repo content across tenantsCVE-2026-52812 · GHSA-6P9M-Q3JP-47H4Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs: UploadRepoFiles writes outside repo working tree via committed parent symCVE-2026-52811 · GHSA-89MR-XQFV-758MVersion ranges need review. |
gogs.io/gogs |
Go |
Critical
|
Fix reported |
|
| Gogs's write-level collaborators can mutate admin-only repository settings via APICVE-2026-52808 · GHSA-268J-37XF-PP52Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)CVE-2026-52814 · GHSA-XP79-5MX3-JX52Version ranges need review. |
gogs.io/gogs |
Go |
Medium
|
Fix reported |
|
| Gogs Missing Authorization in Attachment DownloadCVE-2026-52799 · GHSA-P9F5-H3RX-J5QWVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs Vulnerable to CSRF Leading to Organization Owner TakeoverCVE-2026-52800 · GHSA-PWX3-QCGW-VH7HVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs has the ability to import local repositories via Mirror SettingsCVE-2026-52801 · GHSA-WV27-2VQP-J7G5Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs has an Open Redirect via redirect_toCVE-2026-52802 · GHSA-XXHQ-69MF-W8CRVersion ranges need review. |
gogs.io/gogs |
Go |
Medium
|
Fix reported |
|
| Gogs has a Migration Redirect Bypass that Leads to Internal Repository TheftCVE-2026-52805 · GHSA-G2F5-GJR4-QJVMVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs vulnerable to RCE via git rebase --exec argument injection in pull request mergeCVE-2026-52806 · GHSA-QF6P-P7WW-CWR9Version ranges need review. |
gogs.io/gogs |
Go |
Critical
|
Fix reported |
|
| Gogs has an Authentication Bypass via Unvalidated Reverse Proxy HeadersCVE-2026-25119 · GHSA-W6J9-VW59-27WVVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs has Stored XSS in `.ipynb` PreviewCVE-2026-52798 · GHSA-JQ8V-RMF6-65JWVersion ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
| Gogs: Overwriting critical files results in a denial of serviceCVE-2026-52797 · GHSA-PM6V-2H4W-4RP2Version ranges need review. |
gogs.io/gogs |
Go |
High
|
Fix reported |
|
