https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:34:20.407890+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-248729 EUVD-2026-248729 2026-10-04T03:34:20.476751+00:00 EUVD-2026-248729 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47943 fkie_cve-2025-47943 2026-10-04T03:34:20.476798+00:00

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.

 https://cve.radiocsirt.org/vuln/ghsa-xh32-cx6c-cp4v GHSA-xh32-cx6c-cp4v — Gogs XSS allowed by stored call in PDF renderer 2026-10-04T03:34:20.476844+00:00

Affected: Go: github.com/gogs/gogs, Go: gogs.io/gogs

### Summary

A stored XSS is present in Gogs which allows client-side Javascript code execution.

### Details

Gogs Version: ``` docker images REPOSITORY TAG IMAGE ID CREATED SIZE gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB ```

Application version: `0.14.0+dev`

Local setup using: ```bash # Pull image from Docker Hub. docker pull gogs/gogs

# Create local directory for volume. sudo mkdir -p /var/gogs

# Use `docker run` for the first time. docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs ```

The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/. Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/).

### PoC

1. Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository. 2. Click on the file to be previewed.

![poc](https://github.com/user-attachments/assets/5af1303e-8751-49c8-af2e-d0631dd18957)

### Credits

Edoardo Ottavianelli

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 openSUSE-SU-2025:15405-1 — govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media 2026-10-04T03:34:20.476913+00:00

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1383 WID-SEC-W-2025-1383 — Gogs: Mehrere Schwachstellen 2026-10-04T03:34:20.476979+00:00

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um beliebigen Programmcode auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.