deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-68922
Published: 2025-12-25
Description: OpenOps before 0.6.11 allows remote code execution in the Terraform block.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78
References: https://github.com/openops-cloud/openops/compare/0.6.10...0.6.11; https://github.com/openops-cloud/openops/pull/1767; https://github.com/openops-cloud/openops/releases/tag/0.6.11
CVE: CVE-2025-15074
Published: 2025-12-25
Description: A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ttting888/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.338331
CVE: CVE-2025-15075
Published: 2025-12-25
Description: A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/30; https://itsourcecode.com/; https://vuldb.com/?ctiid.338332
CVE: CVE-2025-15076
Published: 2025-12-25
Description: A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/master-abc/cve/blob/main/Tenda%20CH22%20V1.0.0.1%20Router%20Authentication%20Bypass%20Vulnerability%20in%20R7WebsSecurityHandler%20function.md; https://vuldb.com/?ctiid.338333; https://vuldb.com/?id.338333
CVE: CVE-2025-15077
Published: 2025-12-25
Description: A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/BUPT424201/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.338334
CVE: CVE-2025-15078
Published: 2025-12-25
Description: A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manipulation of the argument sy results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/BUPT424201/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.338335
CVE: CVE-2025-32095
Published: 2025-12-25
Description: Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling message, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-32096
Published: 2025-12-25
Description: Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-48704
Published: 2025-12-25
Description: Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-49088
Published: 2025-12-25
Description: Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-59683
Published: 2025-12-25
Description: Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.
CVSS Score: 8.2 (HIGH)
CWE: CWE-863
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-66377
Published: 2025-12-25
Description: Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes within the installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-66378
Published: 2025-12-25
Description: Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-66379
Published: 2025-12-25
Description: Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted media stream, resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-66443
Published: 2025-12-25
Description: Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://docs.pexip.com/admin/security_bulletins.htm
CVE: CVE-2025-2307
Published: 2025-12-25
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS).This issue affects Aidango: before 2.144.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0487
CVE: CVE-2025-2405
Published: 2025-12-25
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Titarus allows Cross-Site Scripting (XSS).This issue affects Titarus: before 2.144.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0485
CVE: CVE-2025-2406
Published: 2025-12-25
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS).This issue affects Trizbi: before 2.144.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0486
CVE: CVE-2025-15081
Published: 2025-12-25
Description: A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument ddns_name leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://gist.github.com/isstabber/4ed[PII_REDACTED]e50b3e987c3c4ee1f29; https://vuldb.com/?ctiid.338409; https://vuldb.com/?id.338409
CVE: CVE-2025-15082
Published: 2025-12-25
Description: A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://vuldb.com/?ctiid.338410; https://vuldb.com/?id.338410; https://vuldb.com/?submit.707306
CVE: CVE-2025-15083
Published: 2025-12-25
Description: A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulation can lead to on-chip debug and test interface with improper access control. The physical device can be targeted for the attack. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.0 (LOW)
CWE: CWE-1191
References: https://hacklab.eu.org/blogs/zlt_m30s_debug_interface; https://vuldb.com/?ctiid.338411; https://vuldb.com/?id.338411
CVE: CVE-2025-15084
Published: 2025-12-25
Description: A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-266, CWE-284
References: https://github.com/Hwwg/cve/issues/24; https://vuldb.com/?ctiid.338412; https://vuldb.com/?id.338412
CVE: CVE-2025-15085
Published: 2025-12-25
Description: A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-863
References: https://github.com/Hwwg/cve/issues/26; https://vuldb.com/?ctiid.338413; https://vuldb.com/?id.338413
CVE: CVE-2025-68935
Published: 2025-12-25
Description: ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921
CVE: CVE-2025-68936
Published: 2025-12-25
Description: ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921
CVE: CVE-2025-15086
Published: 2025-12-25
Description: A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/Hwwg/cve/issues/27; https://vuldb.com/?ctiid.338414; https://vuldb.com/?id.338414
CVE: CVE-2025-15087
Published: 2025-12-25
Description: A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java. Such manipulation of the argument orderSn leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/Hwwg/cve/issues/30; https://vuldb.com/?ctiid.338415; https://vuldb.com/?id.338415
CVE: CVE-2025-15088
Published: 2025-12-25
Description: A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing a manipulation of the argument keyWord results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md; https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/jepaas-v7.2.8-sqlinject1.md#2%E5%A4%8D%E7%8E%B0replicate; https://vuldb.com/?ctiid.338416
CVE: CVE-2025-14715
Published: 2025-12-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-14820
Published: 2025-12-25
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-15089
Published: 2025-12-25
Description: A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. This affects the function strcpy of the file /goform/APSecurity. The manipulation of the argument wepkey1 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/new/14.md; https://github.com/cymiao1978/cve/blob/main/new/14.md#poc; https://vuldb.com/?ctiid.338418
CVE: CVE-2025-15090
Published: 2025-12-25
Description: A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/new/15.md; https://github.com/cymiao1978/cve/blob/main/new/15.md#poc; https://vuldb.com/?ctiid.338419
CVE: CVE-2025-14913
Published: 2025-12-26
Description: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/frontend-post-submission-manager-lite/tags/1.2.6/includes/classes/class-fpsml-ajax.php#L91; https://plugins.trac.wordpress.org/changeset/3427082/frontend-post-submission-manager-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/19a6b19c-244d-4b30-8db2-b4d06a5f5509?source=cve
CVE: CVE-2025-15091
Published: 2025-12-26
Description: A vulnerability was determined in UTT 进取 512W up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/formPictureUrl. This manipulation of the argument importpictureurl causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/new/16.md; https://github.com/cymiao1978/cve/blob/main/new/16.md#poc; https://vuldb.com/?ctiid.338420
CVE: CVE-2025-68937
Published: 2025-12-26
Description: Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.
CWE: CWE-61
References: https://blog.gitea.com/release-of-1.24.7/; https://codeberg.org/forgejo/forgejo/milestone/27340; https://codeberg.org/forgejo/forgejo/milestone/29156
CVE: CVE-2025-15092
Published: 2025-12-26
Description: A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the argument remark leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/new/17.md; https://github.com/cymiao1978/cve/blob/main/new/17.md#poc; https://vuldb.com/?ctiid.338421
CVE: CVE-2025-15093
Published: 2025-12-26
Description: A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d[PII_REDACTED]6b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing a manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/sunkaifei/FlyCms/; https://github.com/sunkaifei/FlyCms/issues/15; https://vuldb.com/?ctiid.338422
CVE: CVE-2025-15094
Published: 2025-12-26
Description: A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d[PII_REDACTED]6b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/sunkaifei/FlyCms/; https://github.com/sunkaifei/FlyCms/issues/16; https://vuldb.com/?ctiid.338423
CVE: CVE-2025-68938
Published: 2025-12-26
Description: Gitea before 1.25.2 mishandles authorization for deletion of releases.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://blog.gitea.com/release-of-1.25.2/; https://github.com/go-gitea/gitea/pull/36002/commits/d4262131b39899d9e9ee5caa2635c810d476e43f#diff-8962bac89952027d50fa51f31f59d65bedb4c02bde0265eced5cf256cbed306d; https://github.com/go-gitea/gitea/releases/tag/v1.25.2
CVE: CVE-2025-15095
Published: 2025-12-26
Description: A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/postmanlabs/httpbin/issues/735; https://vuldb.com/?ctiid.338424; https://vuldb.com/?id.338424
CVE: CVE-2025-15097
Published: 2025-12-26
Description: A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125 and 2025.1.1.1.31 can resolve this issue. Upgrading the affected component is recommended.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://gist.github.com/apostolovd/f84631eed2f0c0e83e2e174b1480f08c; https://help.alteryx.com/release-notes/en/release-notes/server-release-notes/server-2025-1-release-notes.html; https://ict-strypes.eu/wp-content/uploads/2025/12/Alteryx-Second-Research.pdf
CVE: CVE-2025-15098
Published: 2025-12-26
Description: A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md; https://github.com/AnalogyC0de/public_exp/blob/main/archives/yudao-cloud-bpm_SSRF/report.md#proof-of-concept; https://vuldb.com/?ctiid.338429
CVE: CVE-2025-68939
Published: 2025-12-26
Description: Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
CVSS Score: 8.2 (HIGH)
CWE: CWE-424
References: https://blog.gitea.com/release-of-1.23.0/; https://github.com/go-gitea/gitea/pull/32151; https://github.com/go-gitea/gitea/releases/tag/v1.23.0
CVE: CVE-2025-68940
Published: 2025-12-26
Description: In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://blog.gitea.com/release-of-1.22.5/; https://github.com/go-gitea/gitea/pull/32654; https://github.com/go-gitea/gitea/releases/tag/v1.22.5
CVE: CVE-2025-68941
Published: 2025-12-26
Description: Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-863
References: https://blog.gitea.com/release-of-1.22.3/; https://github.com/go-gitea/gitea/pull/32218; https://github.com/go-gitea/gitea/releases/tag/v1.22.3
CVE: CVE-2025-68942
Published: 2025-12-26
Description: Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.gitea.com/release-of-1.22.2/; https://github.com/go-gitea/gitea/pull/31966; https://github.com/go-gitea/gitea/releases/tag/v1.22.2