CVE Vulnerability Database
Search and browse 420,242 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-117685 | CRITICAL | 9.1 | 0.1% | Nov 1, 2026 | The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction,... |
| CVE-2026-117677 | — | — | 0.2% | Nov 1, 2026 | When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.ya... |
| CVE-2026-117649 | LOW | 3.5 | 0.2% | Nov 1, 2026 | The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, ... |
| CVE-2026-117646 | MEDIUM | 4.3 | 0.2% | Nov 1, 2026 | The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included p... |
| CVE-2026-117635 | MEDIUM | 6.5 | 0.1% | Nov 1, 2026 | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only t... |
| CVE-2026-116474 | MEDIUM | 6.5 | 0.1% | Nov 1, 2026 | The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email ... |
| CVE-2026-116296 | MEDIUM | 6.5 | 0.3% | Nov 1, 2026 | The API routes for releases, release assets, milestones and repository labels did not reject changes to archived reposit... |
| CVE-2026-116289 | CRITICAL | 9.1 | 0.1% | Nov 1, 2026 | Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions r... |
| CVE-2026-114199 | MEDIUM | 5.3 | 0.2% | Nov 1, 2026 | `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner a... |
| CVE-2026-113429 | MEDIUM | 5.4 | 0.2% | Nov 1, 2026 | Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that i... |
| CVE-2026-112887 | MEDIUM | 4.3 | 0.2% | Nov 1, 2026 | Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, org... |
| CVE-2026-120218 | LOW | 3.5 | 0.3% | Nov 1, 2026 | A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of th... |
| CVE-2026-120217 | MEDIUM | 4.3 | 0.3% | Nov 1, 2026 | A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file lo... |
| CVE-2026-120198 | CRITICAL | 10 | 2.1% | Nov 1, 2026 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the f... |
| CVE-2026-118168 | MEDIUM | 5.3 | 0.2% | Nov 1, 2026 | The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler render... |
| CVE-2026-113482 | MEDIUM | 6.8 | 0.2% | Nov 1, 2026 | The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputti... |
| CVE-2026-113481 | MEDIUM | 4.3 | 0.2% | Nov 1, 2026 | The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a po... |
| CVE-2026-107343 | MEDIUM | 4.3 | 0.2% | Nov 1, 2026 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check... |
| CVE-2026-107342 | MEDIUM | 4.3 | 0.2% | Nov 1, 2026 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check... |
| CVE-2026-120197 | CRITICAL | 9.9 | 1.7% | Nov 1, 2026 | A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wap... |
| CVE-2026-120196 | CRITICAL | 9.9 | 1.7% | Nov 1, 2026 | A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/w... |
| CVE-2026-120195 | CRITICAL | 10 | 2.1% | Nov 1, 2026 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the funct... |
| CVE-2026-120192 | MEDIUM | 5.3 | 0.9% | Nov 1, 2026 | A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app... |
| CVE-2026-120252 | MEDIUM | 5.5 | 0.1% | Nov 1, 2026 | imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Defin... |
| CVE-2026-120251 | MEDIUM | 5.5 | 0.1% | Nov 1, 2026 | imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows ... |