These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-90679 is a medium-severity vulnerability affecting Forgejo versions 13.0.0 through 16.0.4. When federation is enabled, an attacker can spoof the identity of any actor in an ActivityPub activity without verifying the HTTP signature was produced by the claimed actor's key. This issue impacts identity integrity but does not allow account takeover or content modification.
CVE-2026-89151 is a low-severity vulnerability affecting Forgejo versions before 16.0.4. It allows the use of restricted API tokens for unintended access to the 'allow maintainer edit' feature. Defenders should assess exposure, particularly in deployment contexts where maintainers have edit privileges. The vulnerability's impact is limited, but verification of affected versions and remediation priority are necessary.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-10T21:17:53.160Z and has not been modified since then. This critical vulnerability in Forgejo, tracked as CVE-2026-89094, allows remote code execution via crafted template repositories. The vulnerability has a CVSS score of 9.9 and is considered critical. Defenders responsible for Forgejo installati [truncated]
The CVE-2026-82556 vulnerability affects Forgejo up to version 15.0.4, specifically in the Repository Migration Handler component. The issue arises from the manipulation of the net.LookupIP function in the services/migrations/allowlist/is_migrate_allowed.go file, leading to a server-side request forgery vulnerability. The attack can be initiated remotely, and the exploit has been made public. To address t [truncated]