Vulnerability database

9,914 matching CVEs.

WordPress onlyExploited (CISA KEV)With public PoC

CVESoftwareSignalsCVSSPublished

CVE-2026-118394Summary: The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit…4.3medium01 Nov 2026

CVE-2026-118386Summary: Workflows triggered by a pull request review were read from the commit named in…6.5medium01 Nov 2026

CVE-2026-117685Summary: The OCI registry's cross-repository blob mount checked the target package agains…9.1critical01 Nov 2026

CVE-2026-117677Summary: When parsing an uploaded Helm chart, Gitea decompressed the archive and read eve…6.5medium01 Nov 2026

CVE-2026-117649Summary: The issue timeline API and the web issue page hid cross-reference events that po…3.5low01 Nov 2026

CVE-2026-117646Summary: The repositories, stars and watching tabs of user profiles and the repository li…4.3medium01 Nov 2026

CVE-2026-117635Summary: The `/api/v1/admin` route group did not enforce the `public-only` restriction of…6.5medium01 Nov 2026

CVE-2026-116474Summary: The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` sy…6.5medium01 Nov 2026

CVE-2026-116296Summary: The API routes for releases, release assets, milestones and repository labels di…6.5medium01 Nov 2026

CVE-2026-116289Summary: Gitea did not reject personal access tokens restricted to public resources (`pub…9.1critical01 Nov 2026

CVE-2026-114199Summary: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with th…5.3medium01 Nov 2026

CVE-2026-113429Summary: Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encodin…5.4medium01 Nov 2026

CVE-2026-112887Summary: Gitea Actions task tokens authenticate to the REST API as a shared system user w…4.3medium01 Nov 2026

CVE-2026-120218Summary: A flaw has been found in Typemill up to 2.26.0. The impacted element is the func…2.0low01 Nov 2026

CVE-2026-120217Summary: A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the…2.1low01 Nov 2026

CVE-2026-120196Summary: A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the func…EPSS 1.7%8.6high01 Nov 2026

CVE-2026-120195Summary: A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94…EPSS 2.1%9.3critical01 Nov 2026

CVE-2026-120251Summary: imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability…6.8medium01 Nov 2026

CVE-2026-120250Summary: OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vul…6.0medium01 Nov 2026

CVE-2026-120247Summary: FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability…6.8medium01 Nov 2026

CVE-2026-120246Summary: FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability…6.8medium01 Nov 2026

CVE-2026-120243Summary: FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability…6.8medium01 Nov 2026

CVE-2026-120190Summary: A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by…2.0low01 Nov 2026

CVE-2026-120189D-Link DIR-505EPSS 1.3%9.3critical01 Nov 2026

CVE-2026-115946Summary: XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an o…9.8critical01 Nov 2026