CVE-2026-52807Gogs has DOM-based XSS via Milestone Name on New Issue PageGogs has DOM-based XSS via Milestone Name on New Issue Page