Gogs

China Open Source gogs.io/ ↗ ⚠ 1 CISA KEV
D
RISKY
27
Total CVEs
9
Crit / High
4
Medium
0%
Unpatched
17%
Patched
8.3
Avg CVSS
1
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
17%
Unpatched
0%
Under Review
78%
Pending
6%
✓ 3 patched ✗ 0 unpatched ~ 14 under review ⏳ 1 pending score
▸ Intelligence by Audience
PoC Available
4 / 20 shown
CISA KEV (Exploited)
1
Shodan Dorks
ssl:"gogs" port:443
org:"Gogs" http.status:200
Top EPSS (Exploitation Probability)
CVE-2022-2024 97.84% exploitation probability
CVE-2025-8110 85.20% exploitation probability
CVE-2024-55947 77.84% exploitation probability
CVE-2022-0415 65.24% exploitation probability
CVE-2024-39931 52.66% exploitation probability
Quick Facts for Reporting
Total CVEs tracked
27
Critical severity
6
Actively exploited (CISA)
1
Unpatched ratio
0%
Avg CVSS score
8.3
Security grade
D (RISKY)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-06-24
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - The Hacker News
The Hacker News 2026-05-28
New Gogs 0-Day Vulnerability Lets Attackers Run Malicious Code on the Server Remotely - CyberSecurityNews
CyberSecurityNews 2026-05-28
Authenticated RCE via Argument Injection in Gogs (NOT FIXED) - Rapid7
Rapid7 2026-05-28
Lack of response to critical vulnerability in Gogs is a reminder of the limits of open source projects - InfoWorld
InfoWorld 2026-05-28
Unpatched Gogs Zero-Day Exploited for Months - SecurityWeek
SecurityWeek 2025-12-11
CISA Flags Actively Exploited Gogs Vulnerability With No Patch - Infosecurity Magazine
Infosecurity Magazine 2026-01-13
▸ Recent CVEs showing 20 of 18
CVE IDSeverityPatchEPSSDate
CVE-2025-64719 4.9 MEDIUM PATCHED / FIX AVAILABLE 0.44% 2026-06-24
CVE-2025-64175 7.7 HIGH PATCHED / FIX AVAILABLE 0.44% 2026-02-06
CVE-2025-64111 9.3 CRITICAL PATCH UNDER REVIEW 1.40% 2026-02-06
CVE-2025-8110 KEV PoC 8.8 HIGH PATCH UNDER REVIEW 85.20% 2025-12-10
CVE-2025-47943 6.3 MEDIUM PATCHED / FIX AVAILABLE 0.36% 2025-06-24
CVE-2024-56731 10.0 CRITICAL PATCH UNDER REVIEW 1.15% 2025-06-24
CVE-2024-55947 8.7 HIGH PATCH UNDER REVIEW 77.84% 2024-12-23
CVE-2024-54148 8.7 HIGH PATCH UNDER REVIEW 0.85% 2024-12-23
CVE-2022-1884 10.0 CRITICAL PATCH UNDER REVIEW 1.84% 2024-11-15
CVE-2024-44625 ? N/A UNKNOWN / UNPATCHED 15.87% 2024-11-15
CVE-2024-39931 9.9 CRITICAL PATCH UNDER REVIEW 52.66% 2024-07-04
CVE-2024-39930 PoC 9.9 CRITICAL PATCH UNDER REVIEW 7.74% 2024-07-04
CVE-2024-39932 9.9 CRITICAL PATCH UNDER REVIEW 17.32% 2024-07-04
CVE-2024-39933 7.7 HIGH PATCH UNDER REVIEW 0.69% 2024-07-04
CVE-2022-2024 9.8 CRITICAL PATCH UNDER REVIEW 97.84% 2023-02-25
CVE-2022-1986 10.0 CRITICAL PATCH UNDER REVIEW 4.42% 2022-06-09
CVE-2022-1992 PoC 10.0 CRITICAL PATCH UNDER REVIEW 2.30% 2022-06-08
CVE-2022-0415 PoC 9.9 CRITICAL PATCH UNDER REVIEW 65.24% 2022-03-21
View all 18 CVEs for Gogs →
▸Intel
Founded2014
CountryChina
LicenseOpen Source
Trust ScoreD — RISKY
Max CVSS10.0
Last Updated2026-06-24
▸Top Weaknesses
CWE-22
Unknown Weakness Type
10 occurrences in Gogs CVEs (37% of total)
CWE-22 ⓘ
10
CWE-79
Cross-Site Scripting (XSS)
4 occurrences in Gogs CVEs (15% of total)
CWE-79 ⓘ
4
CWE-88
Unknown Weakness Type
4 occurrences in Gogs CVEs (15% of total)
CWE-88 ⓘ
4
CWE-862
Unknown Weakness Type
3 occurrences in Gogs CVEs (11% of total)
CWE-862 ⓘ
3
CWE-434
Unrestricted File Upload
1 occurrence in Gogs CVEs (4% of total)
CWE-434 ⓘ
1
CWE-639
Unknown Weakness Type
1 occurrence in Gogs CVEs (4% of total)
CWE-639 ⓘ
1
CWE-59
Unknown Weakness Type
1 occurrence in Gogs CVEs (4% of total)
CWE-59 ⓘ
1
CWE-284 (Improper Access Control)
Unknown Weakness Type
1 occurrence in Gogs CVEs (4% of total)
CWE-284 (Improper Access Control) ⓘ
1
▸Company Profile

Gogs (Go Git Service) is an open-source, self-hosted Git service written in Go, designed to provide a lightweight and easy-to-deploy alternative to platforms like GitHub and GitLab. It is commonly used by small teams and individual developers for version control and code collaboration, with cybersecurity relevance due to its role in managing sensitive source code and the potential for vulnerabilities in its authentication, access control, and repository management features. The project has 26 tracked CVEs, reflecting its exposure to security issues common in self-hosted development tools.

▸Response Metrics
Est. MTTR ⓘ ~333 days (Critical)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↗ +433% worse
CVE count 2026 vs 2025:  3 → 16 CVEs
Patch Speed ⓘ Poor (>65% open)
0% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€700K
Est. GDPR High
€7.0M

Based on 6 critical CVEs, 1 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Gogs D valtersit.com