Gogs

This hub aggregates every CVE we track for Gogs, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Gogs.

• CVE-2026-52797Gogs: Overwriting critical files results in a denial of service8.5Jun 24, 2026
• CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks10.0Jun 24, 2026
• CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES6.8Jun 24, 2026
• CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via API7.1Jun 24, 2026
• CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository Theft8.7Jun 24, 2026
• CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request merge9.9Jun 24, 2026
• CVE-2026-52799Gogs: Missing Authorization in Attachment Download7.5Jun 24, 2026
• CVE-2026-52801Gogs: Ability to import local repositories via Mirror Settings8.1Jun 24, 2026
• CVE-2026-52800Gogs: CSRF Leading to Organization Owner Takeover8.8Jun 24, 2026
• CVE-2026-52802Gogs: Open Redirect via redirect_to in Gogs5.4Jun 24, 2026
• CVE-2026-52798Gogs: Stored XSS in `.ipynb` Preview8.9Jun 24, 2026
• CVE-2026-52796Gogs: DoS in rendering issue index pattern3.5Jun 24, 2026
• CVE-2026-47267Gogs: SSRF in webhook deliveries8.3Jun 24, 2026
• CVE-2026-52795Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity4.3Jun 24, 2026
• CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pages4.9Jun 24, 2026