CISA ADP Vulnrichment

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Forgejo/Forgejo (generic), Forgejo/Forgejo (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Forgejo/Forgejo, Forgejo/Forgejo.
2. 2Review the reported fix. Update Forgejo/Forgejo to 16.0.4; Forgejo/Forgejo to 16.0.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 10, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 10, 2026

Sources and claim methodology

• Source referencecodeberg.org
• Source referencenews.ycombinator.com

Related CVEs

• Buffer overflow in strfmon and strfmon_l right-justification paddingSame generic ecosystem
• Stack-based out-of-bounds write in tdelete during tree rebalancingSame generic ecosystem
• XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+Same generic ecosystem
• fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`Same generic ecosystem
• October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder CallsSame generic ecosystem
• OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenSame generic ecosystem