CVE-2026-26276

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-262787.5fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callb CVE-2026-262799.1Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completel CVE-2026-26289.8The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up CVE-2026-262807.8systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the CVE-2026-262814.4InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vuln CVE-2026-262826.6NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, NanaZip has an out-of-bounds heap rea CVE-2026-262837.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a `CVE-2026-262849.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, Ima CVE-2026-262868.5SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-262877.1External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting CVE-2026-262889.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-262898.2PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive inf