Browse All CVEs
50,459 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62048 |
critical | 9.3 | 0.0034 | 2026-11-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-120235 |
low | 2.1 | 0.0035 | 2026-11-01 | A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected | |
CVE-2026-119480 |
medium | 6.5 | 0.0040 | 2026-11-01 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-120234 |
medium | 5.3 | 0.0030 | 2026-11-01 | A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the func | |
CVE-2026-120233 |
medium | 5.5 | 0.0041 | 2026-11-01 | A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an | |
CVE-2026-120338 |
critical | 10.0 | 0.0077 | 2026-11-01 | Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compi | |
CVE-2026-120232 |
high | 8.5 | 0.0023 | 2026-11-01 | 1 PoC | A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The |
CVE-2026-120231 |
high | 8.6 | 0.0169 | 2026-11-01 | A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is | |
CVE-2026-120230 |
critical | 9.4 | 0.0221 | 2026-11-01 | A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_gro | |
CVE-2026-120229 |
high | 8.5 | 0.0282 | 2026-11-01 | A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the f | |
CVE-2026-117680 |
low | 2.1 | 0.0019 | 2026-11-01 | Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patt | |
CVE-2026-120228 |
high | 8.6 | 0.0165 | 2026-11-01 | A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the f | |
CVE-2026-120227 |
high | 8.6 | 0.0221 | 2026-11-01 | A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function d | |
CVE-2026-120307 |
critical | 9.9 | 0.0048 | 2026-11-01 | The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromCo | |
CVE-2026-120306 |
critical | 9.9 | 0.0036 | 2026-11-01 | Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and | |
CVE-2026-120308 |
critical | 9.9 | 0.0053 | 2026-11-01 | A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The | |
CVE-2026-120226 |
medium | 4.8 | 0.0012 | 2026-11-01 | A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3. | |
CVE-2025-4373 |
medium | 4.8 | 0.0065 | 2026-11-01 | A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_inser | |
CVE-2023-6531 |
high | 7.0 | 0.0022 | 2026-11-01 | A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garb | |
CVE-2023-42756 |
medium | 4.7 | 0.0027 | 2026-11-01 | A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between | |
CVE-2026-13575 |
medium | 5.6 | 0.0107 | 2026-11-01 | HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfilter | |
CVE-2026-120225 |
high | 8.5 | 0.0073 | 2026-11-01 | A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vul | |
CVE-2026-120224 |
high | 8.6 | 0.0038 | 2026-11-01 | A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the | |
CVE-2026-120223 |
low | 1.3 | 0.0032 | 2026-11-01 | A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the fun | |
CVE-2026-120263 |
critical | 9.8 | 0.0034 | 2026-11-01 | When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration | |
CVE-2026-119533 |
high | 7.5 | 0.0028 | 2026-11-01 | Repository and organization project boards listed the pull requests that reference each is | |
CVE-2026-119441 |
high | 7.5 | 0.0026 | 2026-11-01 | `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did | |
CVE-2026-118504 |
medium | 6.5 | 0.0033 | 2026-11-01 | The web interface blocks issue and pull request changes on archived repositories, but seve | |
CVE-2026-118395 |
high | 7.5 | 0.0028 | 2026-11-01 | Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) | |
CVE-2026-118394 |
medium | 4.3 | 0.0020 | 2026-11-01 | The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `group | |
CVE-2026-118386 |
medium | 6.5 | 0.0024 | 2026-11-01 | Workflows triggered by a pull request review were read from the commit named in the review | |
CVE-2026-117685 |
critical | 9.1 | 0.0028 | 2026-11-01 | The OCI registry's cross-repository blob mount checked the target package against the toke | |
CVE-2026-117677 |
medium | 6.5 | 0.0052 | 2026-11-01 | When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar ent | |
CVE-2026-117649 |
low | 3.5 | 0.0026 | 2026-11-01 | The issue timeline API and the web issue page hid cross-reference events that point at iss | |
CVE-2026-117646 |
medium | 4.3 | 0.0020 | 2026-11-01 | The repositories, stars and watching tabs of user profiles and the repository list of orga | |
CVE-2026-117635 |
medium | 6.5 | 0.0026 | 2026-11-01 | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal | |
CVE-2026-116474 |
medium | 6.5 | 0.0017 | 2026-11-01 | The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, | |
CVE-2026-116296 |
medium | 6.5 | 0.0033 | 2026-11-01 | 1 PoC | The API routes for releases, release assets, milestones and repository labels did not reje |
CVE-2026-116289 |
critical | 9.1 | 0.0028 | 2026-11-01 | Gitea did not reject personal access tokens restricted to public resources (`public-only`) | |
CVE-2026-114199 |
medium | 5.3 | 0.0024 | 2026-11-01 | `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the reposito | |
CVE-2026-113429 |
medium | 5.4 | 0.0017 | 2026-11-01 | Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header | |
CVE-2026-112887 |
medium | 4.3 | 0.0027 | 2026-11-01 | Gitea Actions task tokens authenticate to the REST API as a shared system user with a nega | |
CVE-2026-119627 |
medium | 4.3 | 0.0027 | 2026-11-01 | The web profile and RSS/Atom feed routes of users and organizations checked only whether a | |
CVE-2026-119625 |
medium | 4.3 | 0.0024 | 2026-11-01 | The `/{username}` web route accepted personal access tokens over HTTP Basic authentication | |
CVE-2026-120218 |
medium | 5.1 | 0.0025 | 2026-11-01 | 1 PoC | A flaw has been found in Typemill up to 2.26.0. The impacted element is the function Contr |
CVE-2026-120217 |
low | 2.1 | 0.0027 | 2026-11-01 | A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function | |
CVE-2026-118168 |
medium | 5.3 | 0.0020 | 2026-11-01 | The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its fron | |
CVE-2026-113482 |
medium | 6.8 | 0.0024 | 2026-11-01 | The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortc | |
CVE-2026-113481 |
medium | 4.3 | 0.0016 | 2026-11-01 | The Media Library Assistant WordPress plugin before 3.44 does not check that the requestin | |
CVE-2026-107343 |
medium | 4.3 | 0.0015 | 2026-11-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does |