https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:29:53 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-248729 EUVD-2026-248729 https://cve.radiocsirt.org/vuln/euvd-2026-248729 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47943 <p>Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.</p> <p>Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47943 https://cve.radiocsirt.org/vuln/ghsa-xh32-cx6c-cp4v <p><strong>Affected:</strong> Go: github.com/gogs/gogs, Go: gogs.io/gogs</p> <p>### Summary</p> <p>A stored XSS is present in Gogs which allows client-side Javascript code execution.</p> <p>### Details</p> <p>Gogs Version: ``` docker images REPOSITORY TAG IMAGE ID CREATED SIZE gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB ```</p> <p>Application version: `0.14.0+dev`</p> <p>Local setup using: ```bash # Pull image from Docker Hub. docker pull gogs/gogs</p> <p># Create local directory for volume. sudo mkdir -p /var/gogs</p> <p># Use `docker run` for the first time. docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs ```</p> <p>The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/. Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/).</p> <p>### PoC</p> <p>1. Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository. 2. Click on the file to be previewed.</p> <p></p> <p>### Credits</p> <p>Edoardo Ottavianelli</p> <p><strong>Affected:</strong> Go: github.com/gogs/gogs, Go: gogs.io/gogs</p> <p>### Summary</p> <p>A stored XSS is present in Gogs which allows client-side Javascript code execution.</p> <p>### Details</p> <p>Gogs Version: ``` docker images REPOSITORY TAG IMAGE ID CREATED SIZE gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB ```</p> <p>Application version: `0.14.0+dev`</p> <p>Local setup using: ```bash # Pull image from Docker Hub. docker pull gogs/gogs</p> <p># Create local directory for volume. sudo mkdir -p /var/gogs</p> <p># Use `docker run` for the first time. docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs ```</p> <p>The vulnerability is caused by the usage of a vulnerable and outdated component: `pdfjs-1.4.20` under public/plugins/. Read more about this vulnerability at [codeanlabs - CVE-2024-4367](https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/).</p> <p>### PoC</p> <p>1. Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository. 2. Click on the file to be previewed.</p> <p></p> <p>### Credits</p> <p>Edoardo Ottavianelli</p> https://cve.radiocsirt.org/vuln/ghsa-xh32-cx6c-cp4v https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1383 <p>Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um beliebigen Programmcode auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um beliebigen Programmcode auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1383