CVE Vulnerability Database
Search and browse 423,931 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-91184 | HIGH | 8.8 | — | Oct 14, 2026 | Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of... |
| CVE-2026-84471 | HIGH | 7.2 | 0.4% | Oct 14, 2026 | The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7... |
| CVE-2026-78433 | MEDIUM | 5.9 | 0.3% | Oct 14, 2026 | Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026... |
| CVE-2026-78231 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to t... |
| CVE-2026-73814 | MEDIUM | 6.5 | 0.2% | Oct 14, 2026 | Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator w... |
| CVE-2026-73804 | HIGH | 8.1 | 0.2% | Oct 14, 2026 | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's accoun... |
| CVE-2026-73802 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode ... |
| CVE-2026-73800 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pu... |
| CVE-2026-73539 | HIGH | 7.5 | 0.3% | Oct 14, 2026 | Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping ... |
| CVE-2026-73535 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before... |
| CVE-2026-73273 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quota... |
| CVE-2026-73135 | MEDIUM | 5.3 | — | Oct 14, 2026 | Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints ad... |
| CVE-2026-73130 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository in... |
| CVE-2026-73126 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on ... |
| CVE-2026-71301 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull ... |
| CVE-2026-71184 | HIGH | 8.8 | — | Oct 14, 2026 | Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow ... |
| CVE-2026-70407 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, s... |
| CVE-2026-70406 | MEDIUM | 6.5 | — | Oct 14, 2026 | Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only... |
| CVE-2026-70402 | MEDIUM | 5.8 | — | Oct 14, 2026 | Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict ac... |
| CVE-2026-70400 | MEDIUM | 5.4 | — | Oct 14, 2026 | Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository... |
| CVE-2026-70396 | MEDIUM | 5.4 | 0.3% | Oct 14, 2026 | Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enfo... |
| CVE-2026-68964 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. A re... |
| CVE-2026-68957 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-vis... |
| CVE-2026-67577 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted acc... |
| CVE-2026-66877 | HIGH | 8.1 | — | Oct 14, 2026 | Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not ... |