Login Request a demo
FO
Product
forgejo
by forgejo · last CVE Sep 13, 2026
9
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 3High 1Medium 4Low 1
Severity
All severities9Critical3High1Medium4Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add forgejo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-89094
9.9
1%
Sep 10
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled
Affected: 16.0.0 before 16.0.4; before 15.0.8
CVE-2025-68937
9.5
1%
Dec 25
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for…
Affected: 12.0.0 before 13.0.2; before 11.0.7
CVE-2023-49946
9.1
1%
Dec 3
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked
Affected: before 1.20.5-1
Showing 3