CVE-2026-26194

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
gogs	gogs	< 0.14.2

References

https://github.com/gogs/gogs/commit/a000f0c7a632ada40e6829abdeea525db4c0fc2dPatch
https://github.com/gogs/gogs/pull/8175Issue Tracking
https://github.com/gogs/gogs/releases/tag/v0.14.2Release Notes
https://github.com/gogs/gogs/security/advisories/GHSA-v9vm-r24h-6rqmExploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-261956.1Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that CVE-2026-261965.3Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_t CVE-2026-261977.5HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an CVE-2026-261987.5Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressi CVE-2026-261996.5HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a gro CVE-2026-26207.3A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the CVE-2026-262007.8HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-b CVE-2026-262017.5emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consisten CVE-2026-262027.5Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary fi CVE-2026-262036.5PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability CVE-2026-262045.5Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a CVE-2026-262057.1opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.par