CVE-2026-26194

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

March 6, 2026

Last Seen

May 28, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Zero-Day Vulnerability in Gogs Allows Remote Code Execution72.0

A critical argument injection vulnerability (CWE-88) has been discovered in Gogs, a widely used self-hosted Git service, allowing authenticated users to execute arbitrary code on the server. The flaw, identified by Rapid7's Jonah Burgess, has a CVSSv4 score of 9.4 and affects Gogs versions 0.14.2 an...

Gogs Vulnerabilities Lead to XSS and Token Leakage Risks66.8

Gogs, an open source self-hosted Git service, has two critical vulnerabilities prior to version 0.14.2. CVE-2026-26276 allows attackers to execute a DOM-Based XSS via malicious HTML/JavaScript in Milestone names, while CVE-2026-26196 exposes sensitive tokens in URLs, risking data leakage through log...