Red Hat Pagure vulnerabilities

7 CVEs affecting Red Hat Pagure, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-4982, published 2025-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-1000037, published 2019-11-06. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. Pagure: XSS possible in file attachment endpoint
CVE-2017-1002151, published 2017-09-14. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization
CVE-2019-11556, published 2020-09-25. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Pagure before 5.6 allows XSS via the templates/blame.html blame view.
CVE-2019-7628, published 2019-02-08. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on…
CVE-2024-4982, published 2025-05-12. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A directory traversal vulnerability was discovered in Pagure server. If a malicious user submits a specially cratfted git repository they could discover secrets on the server.
CVE-2016-1000007, published 2016-10-07. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Pagure 2.2.1 XSS in raw file endpoint
CVE-2024-4981, published 2025-05-12. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content…