CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...

Cross site scripting

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...

CVE-2009-3265

Opera 9.x/10.x is affected by CVE-2009-3265, a Cross-site scripting (XSS) flaw where rendering of RSS/Atom feeds as scripted content enables injection of arbitrary script/HTML. The underlying issue is the handling of application/rss+xml as scripted content. The vendor reportedly viewed this as a ...

CVE-2009-3265: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as "scripted content." NOTE: the vendor reportedly considers this behavior a "design...

CVE-2009-3263: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web script or HTML via a 1 RSS or 2 Atom feed, related to the rendering of the application/rss+xml content type as XML "active content."...