CVE-2026-25120

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment...

CVE-2025-9118

CVE-2025-9118 is a path traversal vulnerability in the NPM package installation process of Google Cloud Dataform. The flaw allows a remote attacker to read and write files in other customers’ repositories via a maliciously crafted package.json. The CVE is rated CRITICAL (CVSS 4.0 base score 10.0)...