Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 448Last 24 hours2,720 in the last 7 days
- 16,912Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 18 | 18 | 1 | 0 | 42 | 59 |
| 2025 | 1 | 1 | 1 | 0 | 0 | 3 | 17 |
| 2024 | 1 | 2 | 0 | 0 | 0 | 3 | 14 |
| 2023 | 1 | 0 | 0 | 0 | 0 | 1 | 11 |
| 2022 | 4 | 4 | 2 | 0 | 0 | 10 | 10 |
| Title | ||
|---|---|---|
| CVE-2026-123012 | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different…Gogs · Gogs | High7.1 |
| CVE-2026-82402 | Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`gogs · gogs | Medium5.3 |
| CVE-2026-52797 | Gogs: Overwriting critical files results in a denial of servicegogs · gogs | High8.5 |
| CVE-2026-52813 | Gogs: Path Traversal in organization name results in RCE through Git hooksgogs · gogs | Critical10.0 |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenantsgogs · gogs | High7.1 |
| CVE-2026-52811 | Gogs: UploadRepoFiles writes outside repo working tree via committed parent symgogs · gogs | Critical9.0 |
| CVE-2026-52810 | Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusiongogs · gogs | High7.1 |
| CVE-2026-52809 | Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESgogs · gogs | Medium6.8 |
| CVE-2026-52808 | Gogs: Write-level collaborators can mutate admin-only repository settings via APIgogs · gogs | High7.1 |
| CVE-2026-52816 | Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSgogs · gogs | Medium5.4 |
| CVE-2026-52807 | Gogs: DOM-based XSS via Milestone Name on New Issue Pagegogs · gogs | Medium4.8 |
| CVE-2026-52805 | Gogs: Migration Redirect Bypass Leads to Internal Repository Theftgogs · gogs | High8.7 |
| CVE-2026-52806 | Gogs: RCE via git rebase --exec argument injection in pull request mergegogs · gogs | Critical9.9 |
| CVE-2026-52804 | Gogs: Privilege Escalation via Collaboration Access Mode Validationgogs · gogs | Medium5.5 |
| CVE-2026-52799 | Gogs: Missing Authorization in Attachment Downloadgogs · gogs | High7.5 |
| CVE-2026-52801 | Gogs: Ability to import local repositories via Mirror Settingsgogs · gogs | High8.1 |
| CVE-2026-52800 | Gogs: CSRF Leading to Organization Owner Takeovergogs · gogs | High8.8 |
| CVE-2026-52802 | Gogs: Open Redirect via redirect_to in Gogsgogs · gogs | Medium5.4 |
| CVE-2026-52814 | Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)gogs · gogs | Medium5.5 |
| CVE-2026-52798 | Gogs: Stored XSS in `.ipynb` Previewgogs · gogs | High8.9 |
| CVE-2026-52796 | Gogs: DoS in rendering issue index patterngogs · gogs | Low3.5 |
| CVE-2026-47267 | Gogs: SSRF in webhook deliveriesgogs · gogs | High8.3 |
| CVE-2026-25119 | Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headersgogs · gogs | High7.7 |
| CVE-2026-52795 | Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activitygogs · gogs | Medium4.3 |
| CVE-2025-64719 | Gogs: Denial of Service in repository/wiki file listing web pagesgogs · gogs | Medium4.9 |
| CVE-2026-52815 | Gogs: Unauthenticated Organization Teams Information Disclosure via APIgogs · gogs | Medium5.5 |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selectiongogs · gogs | High7.3 |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requestsgogs · gogs | Medium6.9 |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer namesgogs · gogs | Medium6.9 |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletiongogs · gogs | High8.8 |
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verificationgogs · gogs | Critical9.3 |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue commentsgogs · gogs | High8.7 |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modificationgogs · gogs | Medium5.3 |
| CVE-2026-25242 | Gogs allows unauthenticated file uploadsgogs · gogs | Medium6.9 |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interfacegogs · gogs | High7.1 |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteCommentgogs · gogs | Medium5.1 |
| CVE-2026-24135 | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page updategogs · gogs | High7.2 |
| CVE-2026-23633 | Gogs has arbitrary file read/write via path traversal in Git hook editinggogs · gogs | Medium6.5 |
| CVE-2026-23632 | Gogs user can update repository content with read-only permissiongogs · gogs | Medium6.5 |
| CVE-2026-22592 | Gogs is Vulnerable to Denial of Servicegogs · gogs | Medium6.5 |
| CVE-2025-64175 | Gogs Vulnerable to 2FA Bypass via Recovery Codegogs · gogs | High7.7 |
| CVE-2025-64111 | Gogs's update .git/config file allows remote command executiongogs · gogs | Critical9.3 |
| CVE-2025-8110 | File overwrite in file update API in GogsExploitedGogs · Gogs | High8.7 |
| CVE-2025-47943 | Gogs stored XSS in PDF renderergogs · gogs | Medium6.3 |
| CVE-2024-56731 | Gogs deletion of internal files allows remote command executiongogs · gogs | Critical10.0 |
| CVE-2024-55947 | Gogs has a Path Traversal in file update APIgogs · gogs | High8.7 |
| CVE-2024-54148 | Gogs has a Path Traversal in file editing UIgogs · gogs | High8.7 |
| CVE-2022-1884 | Remote Command Execution in gogs/gogsgogs · gogs/gogs | Critical10.0 |
| CVE-2022-2024 | OS Command Injection in gogs/gogsgogs · gogs/gogs | Critical9.8 |
| CVE-2022-32174 | Gogs - XSSgogs · gogs | Critical9.0 |