Advisories · Technology
forgejo.
Every CVE that names forgejo among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
- forgejo
- Broken access control
- CVSS 6.8 Medium
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
- forgejo
- Path traversal
- CVSS 6.9 Medium
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
- forgejo
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Forgejo: Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set…
- Forgejo
- CWE-348
- CVSS 3.5 Low
Incorrect authorization in Forgejo
- Forgejo
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Template injection in Forgejo
- Forgejo
- Code injection
- CVSS 5.3 Medium
Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
- Forgejo
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering
- forgejo
- Cross-site scripting (XSS)
- CVSS 9.5 CriticalCritical · CVSS 9+
Forgejo: Forgejo before 13.0.2 allows attackers to write to unintended files…
- Forgejo
- CWE-61