FO
Vendor
forgejo
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90679 | FO Forgejo Forgejo | 4.3 | Sep 13 | Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content… |
| CVE-2026-89151 | FO Forgejo Forgejo | 3.5 | Sep 11 | Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature |
| CVE-2026-89094 | FO Forgejo Forgejo | 9.9 | Sep 10 | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled |
| CVE-2026-82556 | FO Forgejo Forgejo | 6.3 | Aug 30 | Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery |
| CVE-2026-59102 | FO forgejo forgejo | 5.4 | Jul 2 | Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering |
| CVE-2025-68937 | FO Forgejo Forgejo | 9.5 | Dec 25 | Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for… |
| CVE-2023-49946 | FO Forgejo Forgejo | 9.1 | Dec 3 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked |
| CVE-2023-49948 | FO Forgejo Forgejo | 5.3 | Dec 3 | Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL |
| CVE-2023-49947 | FO Forgejo Forgejo | 7.5 | Dec 3 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication |