Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2025-4268
- CVE-2025-68941, GHSA-xfq3-qj7j-4565
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea
GO-2025-4267
- CVE-2025-68940, GHSA-rrcw-5rjv-vj26
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea
GO-2025-4266
- CVE-2025-68943, GHSA-jhx5-4vr4-f327
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea
GO-2025-4265
- CVE-2025-68946, GHSA-hq57-c72x-4774
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
GO-2025-4264
- CVE-2025-68944, GHSA-f85h-c7m6-cfpm
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.