https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 05:34:33 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2024-yf95833 <p><strong>Affected:</strong> CleanStart: gogs</p> <p>Security vulnerability affects the gogs package. Stored xss bug in GitHub repository gogs/gogs prior to 0.</p> <p><strong>Affected:</strong> CleanStart: gogs</p> <p>Security vulnerability affects the gogs package. Stored xss bug in GitHub repository gogs/gogs prior to 0.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-yf95833 https://cve.radiocsirt.org/vuln/euvd-2026-11695 EUVD-2026-11695 https://cve.radiocsirt.org/vuln/euvd-2026-11695 https://cve.radiocsirt.org/vuln/fkie_cve-2022-1464 <p>Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .</p> <p>Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-1464 https://cve.radiocsirt.org/vuln/ghsa-ff28-f46g-r9g8 <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Impact</p> <p>The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.</p> <p>### Patches</p> <p>Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.</p> <p>### Workarounds</p> <p>[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).</p> <p>### References</p> <p>https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.</p> <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Impact</p> <p>The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.</p> <p>### Patches</p> <p>Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.</p> <p>### Workarounds</p> <p>[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).</p> <p>### References</p> <p>https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.</p> https://cve.radiocsirt.org/vuln/ghsa-ff28-f46g-r9g8 https://cve.radiocsirt.org/vuln/gsd-2022-1464 gsd-2022-1464 https://cve.radiocsirt.org/vuln/gsd-2022-1464