9 matches found
GO-2026-5249 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect via the redirectto parameter. An attacker can redirect users to arbitrary external sites by crafting URLs that bypass validation in the IsSameSite function, which only inspects the first two characters of the URL string an...
CVE-2026-47267
creationtimestamp| type| source ---|---|--- 2026-06-19 02:22:31+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g...
CVE-2026-52802
creationtimestamp| type| source ---|---|--- 2026-06-19 02:21:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr...
CVE-2026-52810
creationtimestamp| type| source ---|---|--- 2026-06-19 02:18:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 2026-06-24 22:21:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xafiefx25...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the DeleteComment function, accessible via the /:owner/:repo/issues/comments/:id/delete endpoint. A user can delete comments from other users' repositories by sending POST requests for known comment IDs...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the DeleteComment function, accessible via the /:owner/:repo/issues/comments/:id/delete endpoint. A user can delete comments from other users' repositories by sending POST requests for known comment IDs...
