Gogs XSS allowed by stored call in PDF renderer

Summary A stored XSS is present in Gogs which allows client-side Javascript code execution. Details Gogs Version: docker images REPOSITORY TAG IMAGE ID CREATED SIZE gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB Application version: 0.14.0+dev Local setup using: bash Pull image from Docker Hub...

CVE-2025-47943

CVE-2025-47943 affects Gogs (self-hosted Git service). The vulnerability is a stored XSS in the PDF rendering path, caused by an outdated pdfjs-1.4.20 component located under public/plugins/. Affected versions are 0.14.0+dev and prior. The issue has been fixed in gogs.io/gogs with version 0.13.3 ...

CVE-2025-47943 Gogs stored XSS in PDF renderer

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...

CVE-2025-47943 Gogs stored XSS in PDF renderer

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...

PT-2026-31498

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A flaw in policy enforcement within the browser's user interface allowed a remote attacker who had already compromised the renderer process to manipulate the Omnibox URL bar by presenti...

GHSA-G5HG-P3PH-G8QG vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-48997 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-48997 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-G5HG-P3PH-G8QG vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-4PG4-QVPC-4Q3H vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-44FP-W29J-9VJ5 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-47944 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-47935 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-47935 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2025-47944 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-44FP-W29J-9VJ5 vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

GHSA-4PG4-QVPC-4Q3H vulnerabilities

Vulnerabilities for packages: grafana-image-renderer...

CVE-2024-36527

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server...

CVE-2024-23642

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting XSS vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a...

CVE-2024-11114

Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...