Forgejo <=16.0.3 Critical RCE
Summary
A critical remote code execution vulnerability has been identified in Forgejo versions up to 16.0.3, allowing potential arbitrary code execution by attackers.
Similar Articles
Forgejo v16.0 is available
Forgejo v16.0 has been released, introducing breaking changes including SSRF hardening for mirrors, removal of EXIF stripping due to licensing, and changes to trusted proxy settings in containers.
Forgejo v15.0 is available
Forgejo v15.0 released on April 16, 2026, marking the 100th release with UI enhancements, security improvements, repository-specific access tokens, and advanced Forgejo Actions capabilities including reusable workflow expansion and OpenID Connect support.
Forgejo v17.0 is available
Forgejo v17.0 已于2026年10月15日发布，这是一个轻量级、社区开发的自托管代码协作平台。新版本包含破坏性变更（如渲染文档中绝对链接的解析方式改变）、弃用 action run webhook 事件，以及 FUNDING.yml 捐赠按钮等新功能。
Forgejo monthly report - May 2026
Forgejo's May 2026 monthly report details the v15 LTS release, security releases for v11 and v14, and updates to Forgejo Runner. The v14 support has ended, and v11 support will end soon, urging upgrades.
@rauchg: Two days ago JFrog dropped CVE-2026-82329, a critical authentication bypass in Artifactory. It’s a CVSS 9.8, a disastro…
The article reports on CVE-2026-82329, a critical authentication bypass in JFrog's Artifactory with a CVSS score of 9.8, and speculates that AI agents may have discovered and exploited it, urging autonomous defense measures.