190 matches found
SUSE CVE-2026-52807
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
CVE-2026-52807 Gogs: DOM-based XSS via Milestone Name on New Issue Page
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
CVE-2026-52807 Gogs: DOM-based XSS via Milestone Name on New Issue Page
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
CVE-2026-52807
Summary (supported by provided docs): Gogs is affected by a DOM-based XSS in the New Issue page when a milestone name contains HTML/JS payloads. The root cause involves client-side rendering: milestone names are rendered with Go’s escaping in new_form.tmpl, but Semantic UI 2.4.2 uses preserveHTML...
CVE-2026-52807 Gogs: DOM-based XSS via Milestone Name on New Issue Page
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
EUVD-2026-39075
Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...
GHSA-VCM5-GVMP-78MP Gogs has DOM-based XSS via Milestone Name on New Issue Page
Summary The fix for GHSA-vgjm-2cpf-4g7c DOM-based XSS via milestone selection was only applied to templates/repo/issue/viewcontent.tmpl but not to templates/repo/issue/newform.tmpl. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page an...
PT-2026-51625
Name of the Vulnerable Software and Affected Versions Gogs affected versions not specified Gitea affected versions not specified Description A stored DOM-based Cross-Site Scripting XSS issue exists where an attacker can store an HTML or JavaScript payload in a milestone name. When a user opens th...
EUVD-2025-178846
Malicious code in fornax-postgres-phoenix-semantic-ui npm...
EUVD-2025-177445
Malicious code in ophiuchus-callisto-semantic-ui-lynx npm...
EUVD-2025-178725
Malicious code in geoarchaeology-superagent-entanglement-semantic-ui npm...
EUVD-2025-178784
Malicious code in gammarayburst-semantic-ui-antares-juno npm...
EUVD-2025-176673
Malicious code in resolvers-semantic-ui-cosmochemistry-andromeda npm...
MAL-2025-185984 Malicious code in callback-zephyr-semantic-ui-carpo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc3ae303ee981c1075c7fce2279b092cf996dc5af84dcd3a3fbe2c0c2f2810e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in transform-semantic-ui-eleventy-phoebe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffc4d6e7b72b0aaa2abde280bb586981de8ed65cc2174a163599fb04f6fa777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176117
Malicious code in superflare-xenon-semantic-ui-fermiparadox npm...
MAL-2025-188799 Malicious code in prettier-oberon-unuk-semantic-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1416ff5d8384ecbdb89cc7b68eabd1e69af5e47c782685dded612d683ca51e37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177500
Malicious code in oberon-semantic-ui-cors-dione npm...