Forgejo vulnerabilities
8 published CVEs name Forgejo among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 2Critical0 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119547
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
forgejo · forgejo
Medium5.3 - CVE-2026-119546
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
forgejo · forgejo
Medium6.8 - CVE-2026-119545
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
forgejo · forgejo
Medium6.9 - CVE-2026-90679
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account…
Forgejo · Forgejo
Medium4.3 - CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.
Forgejo · Forgejo
Low3.5 - CVE-2026-89094
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
Forgejo · Forgejo
Critical9.9 - CVE-2026-59102
Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering
forgejo · forgejo
Low2.1 - CVE-2025-68937
Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository…
Forgejo · Forgejo
Critical9.5