webhook

Sep 24, 2025 GO-2025-4261

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Dec 18, 2025 GO-2025-4261

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Nov 22, 2025 GO-2025-4261

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Nov 4, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Oct 29, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Changes in this version

type HookEventType

+ const HookEventWorkflowRun

Sep 25, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Apr 28, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Oct 25, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Sep 11, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Aug 13, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Aug 4, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jul 15, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jun 20, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jun 19, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jun 10, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Changes in this version

type HookEventType

+ const HookEventPullRequestReview

+ const HookEventWorkflowJob

+ func AllEvents() []HookEventType

+ func (h HookEventType) IsPullRequest() bool

type HookEvents

+ func (he HookEvents) Get(evt HookEventType) bool

Apr 29, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Dec 16, 2024 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

May 12, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Apr 7, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Mar 24, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Mar 4, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Feb 19, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Feb 6, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Feb 5, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Changes in this version

type HookEvents

+ Status bool

Jan 10, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Jan 9, 2025 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Changes in this version

type HookEventType

+ const HookEventStatus

Dec 17, 2024 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Mar 28, 2024 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Dec 13, 2024 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Dec 11, 2024 GO-2025-4258 +1 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

Nov 25, 2024 GO-2025-4258 +2 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

Oct 9, 2024 GO-2025-4258 +2 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

Sep 5, 2024 GO-2025-4258 +3 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 4, 2024 GO-2025-4258 +5 more

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 27, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 27, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 28, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Sep 20, 2023 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 16, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 25, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 22, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 13, 2024 GO-2024-3056 +6 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 26, 2024 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 22, 2024 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 1, 2024 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jan 17, 2024 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

type HookEventType

+ const HookEventSchedule

Dec 21, 2023 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Dec 12, 2023 GO-2024-3056 +7 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Nov 26, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Nov 14, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 19, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 6, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Sep 20, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 7, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Nov 26, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 3, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Sep 8, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Aug 20, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 29, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 22, 2023 GO-2024-3056 +8 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 16, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

type HookEventType

+ const HookEventPullRequestReviewRequest

type HookEvents

+ PullRequestReviewRequest bool

Jun 24, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 23, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 7, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 22, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 4, 2023 GO-2024-3056 +9 more

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 3, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 27, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 13, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 20, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

+ type HookEvent struct

+ BranchFilter string

+ ChooseEvents bool

+ PushOnly bool

+ SendEverything bool

+ type HookEventType string

+ const HookEventCreate

+ const HookEventDelete

+ const HookEventFork

+ const HookEventIssueAssign

+ const HookEventIssueComment

+ const HookEventIssueLabel

+ const HookEventIssueMilestone

+ const HookEventIssues

+ const HookEventPackage

+ const HookEventPullRequest

+ const HookEventPullRequestAssign

+ const HookEventPullRequestComment

+ const HookEventPullRequestLabel

+ const HookEventPullRequestMilestone

+ const HookEventPullRequestReviewApproved

+ const HookEventPullRequestReviewComment

+ const HookEventPullRequestReviewRejected

+ const HookEventPullRequestSync

+ const HookEventPush

+ const HookEventRelease

+ const HookEventRepository

+ const HookEventWiki

+ func (h HookEventType) Event() string

+ type HookEvents struct

+ Create bool

+ Delete bool

+ Fork bool

+ IssueAssign bool

+ IssueComment bool

+ IssueLabel bool

+ IssueMilestone bool

+ Issues bool

+ Package bool

+ PullRequest bool

+ PullRequestAssign bool

+ PullRequestComment bool

+ PullRequestLabel bool

+ PullRequestMilestone bool

+ PullRequestReview bool

+ PullRequestSync bool

+ Push bool

+ Release bool

+ Repository bool

+ Wiki bool

+ type HookStatus int

+ const HookStatusFail

+ const HookStatusNone

+ const HookStatusSucceed

+ type HookType = string

+ const DINGTALK

+ const DISCORD

+ const FEISHU

+ const GITEA

+ const GOGS

+ const MATRIX

+ const MSTEAMS

+ const PACKAGIST

+ const SLACK

+ const TELEGRAM

+ const WECHATWORK

Mar 5, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 22, 2023 GO-2023-1894 +10 more

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 14, 2020 GO-2022-0442 +19 more

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 7, 2021 GO-2022-0442 +19 more

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 23, 2021 GO-2022-0442 +19 more

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 21, 2021 GO-2022-0353 +20 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 7, 2021 GO-2022-0353 +20 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 4, 2021 GO-2022-0353 +21 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 1, 2021 GO-2022-0353 +21 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Dec 28, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

type FeishuPayload

+ Content struct{ ... }

+ MsgType string

Dec 2, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

type DingtalkPayload

+ func (d *DingtalkPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (d *DingtalkPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (d *DingtalkPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (d *DingtalkPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

type DiscordPayload

+ func (d *DiscordPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (d *DiscordPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (d *DiscordPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (d *DiscordPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (d *DiscordPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (d *DiscordPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (d *DiscordPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (d *DiscordPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (d *DiscordPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (d *DiscordPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

type FeishuPayload

+ func (f *FeishuPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (f *FeishuPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (f *FeishuPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (f *FeishuPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (f *FeishuPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (f *FeishuPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (f *FeishuPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (f *FeishuPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (f *FeishuPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (f *FeishuPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

type MSTeamsPayload

+ func (m *MSTeamsPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (m *MSTeamsPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

type MatrixPayloadUnsafe

+ func (m *MatrixPayloadUnsafe) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Push(p *api.PushPayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (m *MatrixPayloadUnsafe) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

+ type PayloadConvertor interface

+ Create func(*api.CreatePayload) (api.Payloader, error)

+ Delete func(*api.DeletePayload) (api.Payloader, error)

+ Fork func(*api.ForkPayload) (api.Payloader, error)

+ Issue func(*api.IssuePayload) (api.Payloader, error)

+ IssueComment func(*api.IssueCommentPayload) (api.Payloader, error)

+ PullRequest func(*api.PullRequestPayload) (api.Payloader, error)

+ Push func(*api.PushPayload) (api.Payloader, error)

+ Release func(*api.ReleasePayload) (api.Payloader, error)

+ Repository func(*api.RepositoryPayload) (api.Payloader, error)

+ Review func(*api.PullRequestPayload, models.HookEventType) (api.Payloader, error)

type SlackPayload

+ Color string

+ func (s *SlackPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (s *SlackPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (s *SlackPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (s *SlackPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (s *SlackPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (s *SlackPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (s *SlackPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (s *SlackPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (s *SlackPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (s *SlackPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

type TelegramPayload

+ func (t *TelegramPayload) Create(p *api.CreatePayload) (api.Payloader, error)

+ func (t *TelegramPayload) Delete(p *api.DeletePayload) (api.Payloader, error)

+ func (t *TelegramPayload) Fork(p *api.ForkPayload) (api.Payloader, error)

+ func (t *TelegramPayload) Issue(p *api.IssuePayload) (api.Payloader, error)

+ func (t *TelegramPayload) IssueComment(p *api.IssueCommentPayload) (api.Payloader, error)

+ func (t *TelegramPayload) PullRequest(p *api.PullRequestPayload) (api.Payloader, error)

+ func (t *TelegramPayload) Push(p *api.PushPayload) (api.Payloader, error)

+ func (t *TelegramPayload) Release(p *api.ReleasePayload) (api.Payloader, error)

+ func (t *TelegramPayload) Repository(p *api.RepositoryPayload) (api.Payloader, error)

+ func (t *TelegramPayload) Review(p *api.PullRequestPayload, event models.HookEventType) (api.Payloader, error)

Nov 10, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 14, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 17, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Nov 16, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Oct 1, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Sep 3, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 28, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jul 11, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 21, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 18, 2020 GO-2022-0353 +22 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

+ func MatrixLinkFormatter(url string, text string) string

+ func MatrixLinkToRef(repoURL, ref string) string

+ type FeishuPayload struct

+ Text string

+ Title string

+ func GetFeishuPayload(p api.Payloader, event models.HookEventType, meta string) (*FeishuPayload, error)

+ func (p *FeishuPayload) JSONPayload() ([]byte, error)

+ func (p *FeishuPayload) SetSecret(_ string)

+ type MatrixMeta struct

+ AccessToken string

+ HomeserverURL string

+ MessageType int

+ Room string

+ func GetMatrixHook(w *models.Webhook) *MatrixMeta

+ type MatrixPayloadSafe struct

+ Body string

+ Commits []*api.PayloadCommit

+ Format string

+ FormattedBody string

+ MsgType string

+ type MatrixPayloadUnsafe struct

+ AccessToken string

+ func GetMatrixPayload(p api.Payloader, event models.HookEventType, meta string) (*MatrixPayloadUnsafe, error)

+ func (p *MatrixPayloadUnsafe) JSONPayload() ([]byte, error)

+ func (p *MatrixPayloadUnsafe) SetSecret(_ string)

Jun 8, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 18, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jan 8, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 21, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jun 18, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 30, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

May 9, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Apr 1, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 10, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Mar 6, 2020 GO-2022-0353 +23 more

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 16, 2020 GO-2022-0310 +24 more

  GO-2022-0310: Capture-replay in Gitea in code.gitea.io/gitea

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Feb 10, 2020 GO-2022-0310 +24 more

  GO-2022-0310: Capture-replay in Gitea in code.gitea.io/gitea

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Changes in this version

+ func Deliver(t *models.HookTask) error

+ func DeliverHooks(ctx context.Context)

+ func InitDeliverHooks()

+ func PrepareWebhook(w *models.Webhook, repo *models.Repository, event models.HookEventType, ...) error

+ func PrepareWebhooks(repo *models.Repository, event models.HookEventType, p api.Payloader) error

+ func SlackLinkFormatter(url string, text string) string

+ func SlackLinkToRef(repoURL, ref string) string

+ func SlackShortTextFormatter(s string) string

+ func SlackTextFormatter(s string) string

+ type DingtalkPayload dingtalk.Payload

+ func GetDingtalkPayload(p api.Payloader, event models.HookEventType, meta string) (*DingtalkPayload, error)

+ func (p *DingtalkPayload) JSONPayload() ([]byte, error)

+ func (p *DingtalkPayload) SetSecret(_ string)

+ type DiscordEmbed struct

+ Author DiscordEmbedAuthor

+ Color int

+ Description string

+ Fields []DiscordEmbedField

+ Footer DiscordEmbedFooter

+ Title string

+ URL string

+ type DiscordEmbedAuthor struct

+ IconURL string

+ Name string

+ URL string

+ type DiscordEmbedField struct

+ Name string

+ Value string

+ type DiscordEmbedFooter struct

+ Text string

+ type DiscordMeta struct

+ IconURL string

+ Username string

+ func GetDiscordHook(w *models.Webhook) *DiscordMeta

+ type DiscordPayload struct

+ AvatarURL string

+ Content string

+ Embeds []DiscordEmbed

+ TTS bool

+ Username string

+ Wait bool

+ func GetDiscordPayload(p api.Payloader, event models.HookEventType, meta string) (*DiscordPayload, error)

+ func (p *DiscordPayload) JSONPayload() ([]byte, error)

+ func (p *DiscordPayload) SetSecret(_ string)

+ type MSTeamsAction struct

+ Name string

+ Targets []MSTeamsActionTarget

+ Type string

+ type MSTeamsActionTarget struct

+ Os string

+ URI string

+ type MSTeamsFact struct

+ Name string

+ Value string

+ type MSTeamsPayload struct

+ Context string

+ PotentialAction []MSTeamsAction

+ Sections []MSTeamsSection

+ Summary string

+ ThemeColor string

+ Title string

+ Type string

+ func GetMSTeamsPayload(p api.Payloader, event models.HookEventType, meta string) (*MSTeamsPayload, error)

+ func (p *MSTeamsPayload) JSONPayload() ([]byte, error)

+ func (p *MSTeamsPayload) SetSecret(_ string)

+ type MSTeamsSection struct

+ ActivityImage string

+ ActivitySubtitle string

+ ActivityTitle string

+ Facts []MSTeamsFact

+ Text string

+ type SlackAttachment struct

+ Color string

+ Fallback string

+ Text string

+ Title string

+ TitleLink string

+ type SlackMeta struct

+ Channel string

+ Color string

+ IconURL string

+ Username string

+ func GetSlackHook(w *models.Webhook) *SlackMeta

+ type SlackPayload struct

+ Attachments []SlackAttachment

+ Channel string

+ IconURL string

+ LinkNames int

+ Text string

+ UnfurlLinks int

+ Username string

+ func GetSlackPayload(p api.Payloader, event models.HookEventType, meta string) (*SlackPayload, error)

+ func (p *SlackPayload) JSONPayload() ([]byte, error)

+ func (p *SlackPayload) SetSecret(_ string)

+ type TelegramMeta struct

+ BotToken string

+ ChatID string

+ func GetTelegramHook(w *models.Webhook) *TelegramMeta

+ type TelegramPayload struct

+ DisableWebPreview bool

+ Message string

+ ParseMode string

+ func GetTelegramPayload(p api.Payloader, event models.HookEventType, meta string) (*TelegramPayload, error)

+ func (p *TelegramPayload) JSONPayload() ([]byte, error)

+ func (p *TelegramPayload) SetSecret(_ string)

Jan 22, 2020 GO-2022-0310 +24 more

  GO-2022-0310: Capture-replay in Gitea in code.gitea.io/gitea

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea

Jan 8, 2020 GO-2022-0310 +24 more

  GO-2022-0310: Capture-replay in Gitea in code.gitea.io/gitea

  GO-2022-0353: Path Traversal in Gitea in code.gitea.io/gitea

  GO-2022-0442: Arbitrary file deletion in gitea in code.gitea.io/gitea

  GO-2022-0450: Shell command injection in gitea in code.gitea.io/gitea

  GO-2022-0609: Gitea Missing Authorization vulnerability in code.gitea.io/gitea

  GO-2022-0612: Stored Cross-site Scripting in gitea in code.gitea.io/gitea

  GO-2022-0830: Denial of Service in Gitea in code.gitea.io/gitea

  GO-2022-0832: Cross-site Scripting in Gitea in code.gitea.io/gitea

  GO-2022-1065: Gitea vulnerable to Argument Injection in code.gitea.io/gitea

  GO-2023-1894: code.gitea.io/gitea Open Redirect vulnerability

  GO-2023-1971: Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea

  GO-2023-1999: Gitea erroneous repo clones in code.gitea.io/gitea

  GO-2024-2752: Gitea Open Redirect in code.gitea.io/gitea

  GO-2024-2757: Buffer Overflow in gitea in code.gitea.io/gitea

  GO-2024-2769: Gitea allowed assignment of private issues in code.gitea.io/gitea

  GO-2024-3056: Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

  GO-2025-4258: Gitea mishandles authorization for deletion of releases in code.gitea.io/gitea

  GO-2025-4261: Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea

  GO-2025-4262: Gitea: anonymous user can visit private user's project in code.gitea.io/gitea

  GO-2025-4263: Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text in code.gitea.io/gitea

  GO-2025-4264: Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

  GO-2025-4265: Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea

  GO-2025-4266: Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea

  GO-2025-4267: Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea

  GO-2025-4268: Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea