kadet-hub logokadet-hub

Image security report: forgejo recipe

forgejo: grade D, 15 findings, one per advisory and package, in the 1 image of version 1.0.0: CRITICAL 0, HIGH 9, MEDIUM 4, LOW 0, UNKNOWN 2. Scanned 2026-11-07 11:47 UTC.

Trivy 0.76.1 scanned the images with the vulnerability database of 2026-11-07. A finding is one advisory in one package of one image, so an advisory in two packages counts twice. The grade is Artifact Hub's: F with a CRITICAL finding, D with HIGH, C with MEDIUM, B with LOW, - with UNKNOWN findings only, A without findings. It rates known vulnerabilities in third-party images, not the recipe itself.

code.forgejo.org/forgejo/forgejo:15.0.11-rootless@sha256:3cd6bc2b74c87cbde0a0fd527c9665cb416f5a0540dee54fe5afb3fa2df9f40c

CRITICAL 0, HIGH 9, MEDIUM 4, LOW 0, UNKNOWN 2

IDSeverityPackageVersionFixed in
CVE-2026-113351HIGHlibexpat2.9.0-r02.10.0-r0
CVE-2026-115506HIGHlibexpat2.9.0-r02.10.0-r0
CVE-2026-117610HIGHlibexpat2.9.0-r02.10.0-r0
CVE-2026-118370HIGHlibexpat2.9.0-r02.10.0-r0
CVE-2026-123158HIGHopenssh-client-common10.2_p1-r010.2_p1-r1
CVE-2026-123158HIGHopenssh-client-default10.2_p1-r010.2_p1-r1
CVE-2026-123158HIGHopenssh-keygen10.2_p1-r010.2_p1-r1
CVE-2026-78661HIGHgolang.org/x/netv0.60.00.62.0
CVE-2026-78661HIGHgolang.org/x/netv0.60.00.62.0
CVE-2026-114437MEDIUMgithub.com/go-chi/chi/v5v5.3.25.4.0
CVE-2026-4738MEDIUMzlib1.3.2-r11.4-r0
CVE-2026-97045MEDIUMgolang.org/x/netv0.60.00.62.0
CVE-2026-97045MEDIUMgolang.org/x/netv0.60.00.62.0
GO-2026-5932UNKNOWNgolang.org/x/cryptov0.57.00.58.1-0.20261009181718-2f1f834330b2
GO-2026-5932UNKNOWNgolang.org/x/cryptov0.57.00.58.1-0.20261009181718-2f1f834330b2