Developer Tools

In Gogs versions prior to 0.14.2 a medium severity vulnerability CVE-2026-26196 was detected. This vulnerability allows attackers to obtain access tokens because the API accepts tokens in URL parameters such as `token` and `access_token`, which can be exposed through logs, browser history, or referrers. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26196.

In Gogs versions prior to 0.14.2 a medium severity vulnerability CVE-2026-26195 was detected. This vulnerability allows attackers to perform Stored Cross-Site Scripting (XSS) through author and committer names in branch and wiki views due to unsafe template rendering combined with permissive sanitizer handling of data URLs. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26195.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26194 was detected. This vulnerability allows attackers to inject arbitrary Git options when deleting a release if a user-controlled tag name is passed without proper sanitization, potentially manipulating the release deletion process. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26194.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26022 was detected. This vulnerability allows authenticated attackers to inject and execute arbitrary JavaScript via data URI schemes in issue comments or descriptions, due to insufficient sanitization. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26022.

In Gogs versions prior to 0.14.2 a critical severity vulnerability CVE-2026-25921 was detected. This vulnerability allows attackers to maliciously overwrite Git LFS objects across different repositories due to missing content hash verification, potentially enabling supply-chain attacks. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25921.

In Gogs versions prior to 0.14.2 a high severity vulnerability CVE-2026-26276 was detected. This vulnerability allows attackers to store malicious HTML or JavaScript payloads in a repository’s Milestone name, which can trigger a DOM-based Cross-Site Scripting (XSS) attack when another user selects that milestone on the New Issue page. To address this issue, users should upgrade Gogs to version 0.14.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26276.

In Jenkins versions 2.483 through 2.550, and LTS versions 2.492.1 through 2.541.1 a high severity vulnerability CVE-2026-27099 was detected. This vulnerability allows attackers with Agent/Configure or Agent/Disconnect permissions to inject malicious scripts through the “Mark temporarily offline” offline cause description, which is not properly escaped before being stored and displayed. To address this issue, users should upgrade Jenkins to versions 2.551 or 2.541.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27099.

In Gogs versions 0.13.4 and prior a medium severity vulnerability CVE-2026-25120 was detected. This vulnerability allows repository administrators to delete comments from other repositories by supplying arbitrary comment IDs due to missing repository ownership validation in the DeleteComment API. To address this issue, users should upgrade Gogs to version 0.14.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25120.

In Gogs versions 0.13.4 and prior a high severity vulnerability CVE-2026-25232 was detected. This vulnerability allows authenticated attackers with write permissions to delete protected branches, including the default branch, via a direct POST request to the web interface, bypassing branch protection mechanisms and enabling privilege escalation to perform administrative-level operations. To address this issue, users should upgrade Gogs to version 0.14.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-25232.