Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2025-68941, GHSA-xfq3-qj7j-4565
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
- Unreviewed
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea
- CVE-2025-68940, GHSA-rrcw-5rjv-vj26
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
- Unreviewed
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea
- CVE-2025-68943, GHSA-jhx5-4vr4-f327
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
- Unreviewed
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order in code.gitea.io/gitea
- CVE-2025-68946, GHSA-hq57-c72x-4774
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
- Unreviewed
Gitea vulnerable to Cross-site Scripting in code.gitea.io/gitea
- CVE-2025-68944, GHSA-f85h-c7m6-cfpm
- Affects: code.gitea.io/gitea
- Published: Dec 30, 2025
- Unreviewed
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.