Gogs

Gogs is a self-hosted Git service designed for smaller teams and organizations, presenting a narrowly scoped but strategically important attack surface as it often runs in trusted internal environments and manages source-code access. Vulnerabilities affecting the product skew strongly toward critical severity and frequently acquire public exploit code, reflecting the authentication, input handling, and system integration demands of a code-repository application. The exposure recurs persistently through path-traversal, cross-site scripting, missing authorization, OS command injection, and server-side request forgery weaknesses—a pattern characteristic of user-facing web services that interact with underlying version-control operations and file systems. Because Gogs deployments often control access to sensitive codebases and CI/CD systems, these vulnerability classes carry outsized impact relative to the product's narrow user base. Live exploitation activity and severity counts are shown alongside this summary.