forgejo 相關的公開 CVE 漏洞與安全風險資訊，提供 CVSS、EPSS、公開時間與漏洞情報資料，協助評估潛在風險與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-68937 | Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later. | [email protected] | 9.5 | 0.49% | 2025-12-25 | 2026-06-17 |
| CVE-2023-49948 | Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) to a URL. | [email protected] | 5.3 | 0.81% | 2023-12-03 | 2026-06-17 |
| CVE-2023-49947 | Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. | [email protected] | 7.5 | 0.61% | 2023-12-03 | 2026-06-17 |
| CVE-2023-49946 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unauthorized actions. | [email protected] | 9.1 | 0.87% | 2023-12-03 | 2026-06-17 |