Vendor

gogs

1 of 7 gogs CVEs in Patchfirst (14%) are in of vulnerabilities exploited in the wild.

CVEs: 7
In CISA KEV: 114%
Known ransomware use: 0
Median days to KEV: 33; from publication
Latest KEV listing: 12 Jan 2026

Watch gogs Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Gogs In KEV: 1 CVEs: 1
gogs In KEV: 0 CVEs: 4
gogs/gogs In KEV: 0 CVEs: 2

Top ATT&CK techniques

What attackers do with gogs CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 1
T1059Command and Scripting Interpreter CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/gogs.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are gogs CVEs linked to the technique. Each link’s provenance is on the CVE page.

gogs CVEs

7 CVEs, by priority

CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks
gogs · gogsPublic exploitCritical · 10.05 reports
1.1%Top 34%
77.5priority
CVE-2025-8110Gogs Path Traversal Vulnerability
Gogs · GogsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
85.2%Top 0.29%
74.1priority
CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request merge
gogs · gogsPublic exploitCritical · 9.9
7.9%Top 5.3%
73.0priority
CVE-2024-55947Gogs has a Path Traversal in file update API
gogs · gogsPublic exploitHigh · 8.7
77.8%Top 0.43%
32.4priority
CVE-2022-0415Remote Command Execution in uploading repository file in gogs/gogs
gogs · gogs/gogsPublic exploitCritical · 9.9
65.9%Top 0.73%
31.8priority
CVE-2022-32174Gogs - XSS
gogs · gogsCritical · 9.0
58.2%Top 0.91%
27.5priority
CVE-2022-2024OS Command Injection in gogs/gogs
gogs · gogs/gogsCritical · 9.8
97.8%Top 0.09%
26.8priority