Open Source Gogs <0.14.3

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical2high1medium0low

updated 2026-10-27

vulnerabilities (28)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-52806US	—	7.93% (95th)	Exploit	no fix	2026-06-24	—
CVE-2024-39930US	critical9.9	7.74% (95th)	Exploit	no fix	2024-07-04	—
CVE-2026-52813US	—	1.11% (66th)	Exploit	no fix	2026-06-24	—
CVE-2026-52810US	—	0.43% (37th)	Exploit	no fix	2026-06-24	—
CVE-2024-39932US	critical9.9	16.3% (97th)	—	no fix	2024-07-04	—
CVE-2026-52815US	—	1.49% (74th)	—	no fix	2026-06-24	—
CVE-2022-1285US	medium6.5	1.12% (66th)	—	no fix	2022-06-01	—
CVE-2026-25119US	—	0.86% (58th)	—	no fix	2026-06-24	—
CVE-2024-39933US	high7.7	0.69% (53rd)	—	no fix	2024-07-04	—
CVE-2026-52816US	—	0.68% (52nd)	—	no fix	2026-06-24	—
CVE-2026-52801US	—	0.57% (47th)	—	no fix	2026-06-24	—
CVE-2026-52802US	—	0.55% (46th)	—	no fix	2026-06-24	—
CVE-2026-52814US	—	0.55% (46th)	—	no fix	2026-06-24	—
CVE-2026-26194US	high7.3	0.53% (45th)	—	no fix	2026-03-05	—
CVE-2026-52804US	—	0.50% (43rd)	—	no fix	2026-06-24	—
CVE-2026-52807US	—	0.48% (41st)	—	no fix	2026-06-24	—
CVE-2026-52808US	—OT elevated	0.48% (41st)	—	no fix	2026-06-24	—
CVE-2026-52811US	—	0.47% (41st)	—	no fix	2026-06-24	—
CVE-2025-64719US	—	0.44% (38th)	—	no fix	2026-06-24	—
CVE-2026-52798US	—	0.43% (37th)	—	no fix	2026-06-24	—
CVE-2026-52799US	—OT elevated	0.42% (36th)	—	no fix	2026-06-24	—
CVE-2026-47267US	—	0.42% (36th)	—	no fix	2026-06-24	—
CVE-2026-52805US	—	0.38% (32nd)	—	no fix	2026-06-24	—
CVE-2026-52796US	—	0.28% (21st)	—	no fix	2026-06-24	—
CVE-2026-52795US	—OT elevated	0.28% (20th)	—	no fix	2026-06-24	—
CVE-2026-52800US	—	0.25% (16th)	—	no fix	2026-06-24	—
CVE-2026-52812US	—OT elevated	0.24% (15th)	—	no fix	2026-06-24	—
CVE-2026-52809US	—	0.20% (10th)	—	no fix	2026-06-24	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')3 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs
CWE-862Missing Authorization2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine1 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)28 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan