CVE Vulnerability Database
Search and browse 423,547 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112112 | LOW | 2.3 | 0.3% | Oct 18, 2026 | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject F... |
| CVE-2026-112111 | MEDIUM | 5.1 | 0.3% | Oct 18, 2026 | The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_t... |
| CVE-2026-112029 | LOW | 2.5 | 0.1% | Oct 18, 2026 | A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doct... |
| CVE-2026-112028 | MEDIUM | 6.5 | 0.3% | Oct 18, 2026 | A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930... |
| CVE-2026-112027 | MEDIUM | 5.3 | 0.3% | Oct 18, 2026 | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f6138... |
| CVE-2026-112026 | LOW | 3.7 | 0.2% | Oct 18, 2026 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a061... |
| CVE-2026-108519 | — | — | — | Oct 18, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| CVE-2026-112025 | HIGH | 7.3 | 0.5% | Oct 18, 2026 | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61... |
| CVE-2026-97859 | MEDIUM | 6.5 | 0.2% | Oct 18, 2026 | Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscription... |
| CVE-2026-97204 | LOW | 3.1 | 0.1% | Oct 18, 2026 | Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, an... |
| CVE-2026-110494 | MEDIUM | 6.3 | 0.1% | Oct 18, 2026 | Adding attachments to a release checked the repository and release of an attachment but not whether it was already linke... |
| CVE-2026-110324 | MEDIUM | 6.5 | 0.2% | Oct 18, 2026 | The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfol... |
| CVE-2026-110311 | MEDIUM | 4.3 | 0.2% | Oct 18, 2026 | Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which ma... |
| CVE-2026-109844 | MEDIUM | 4.3 | 0.1% | Oct 18, 2026 | `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the... |
| CVE-2026-109553 | HIGH | 7.5 | 0.2% | Oct 18, 2026 | Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only p... |
| CVE-2026-107686 | MEDIUM | 4.3 | 0.2% | Oct 18, 2026 | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users w... |
| CVE-2026-107618 | HIGH | 8.1 | 0.2% | Oct 18, 2026 | `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, s... |
| CVE-2026-105964 | MEDIUM | 6.5 | 0.2% | Oct 18, 2026 | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who ... |
| CVE-2026-105661 | MEDIUM | 5.3 | 0.2% | Oct 18, 2026 | Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home han... |
| CVE-2026-104627 | MEDIUM | 5.4 | 0.1% | Oct 18, 2026 | The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking... |
| CVE-2024-4457 | CRITICAL | 9.1 | 0.4% | Oct 18, 2026 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness ... |
| CVE-2026-111993 | LOW | 3.3 | 0.1% | Oct 18, 2026 | A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the funct... |
| CVE-2026-111992 | MEDIUM | 6.3 | 0.3% | Oct 18, 2026 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.... |
| CVE-2026-98868 | — | — | — | Oct 18, 2026 | In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment ... |
| CVE-2026-98867 | — | — | — | Oct 18, 2026 | In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persis... |