CVE Vulnerability Database
Search and browse 423,931 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-66874 | MEDIUM | 6.5 | — | Oct 14, 2026 | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped statu... |
| CVE-2026-66853 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts witho... |
| CVE-2026-66849 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without ex... |
| CVE-2026-63792 | MEDIUM | 5.3 | — | Oct 14, 2026 | Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pul... |
| CVE-2026-63021 | MEDIUM | 6.5 | — | Oct 14, 2026 | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggrega... |
| CVE-2026-62925 | MEDIUM | 6.5 | — | Oct 14, 2026 | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO da... |
| CVE-2026-60021 | MEDIUM | 6.5 | 0.3% | Oct 14, 2026 | Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration t... |
| CVE-2026-60018 | MEDIUM | 6.5 | — | Oct 14, 2026 | Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a... |
| CVE-2026-60010 | MEDIUM | 6.5 | — | Oct 14, 2026 | Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organ... |
| CVE-2026-60008 | LOW | 3.5 | — | Oct 14, 2026 | Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while di... |
| CVE-2026-59774 | CRITICAL | 9.8 | — | Oct 14, 2026 | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without prevent... |
| CVE-2026-59766 | MEDIUM | 4.3 | — | Oct 14, 2026 | Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returnin... |
| CVE-2026-53613 | HIGH | 7 | 0.1% | Oct 14, 2026 | util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in ... |
| CVE-2026-53612 | HIGH | 7 | 0.1% | Oct 14, 2026 | util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUI... |
| CVE-2026-25946 | MEDIUM | 5.3 | — | Oct 14, 2026 | When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validat... |
| CVE-2026-15176 | HIGH | 8.1 | — | Oct 14, 2026 | A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive t... |
| CVE-2026-110650 | CRITICAL | 9.8 | 3.0% | Oct 14, 2026 | The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that all... |
| CVE-2026-110649 | CRITICAL | 9.8 | 2.5% | Oct 14, 2026 | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by ... |
| CVE-2026-110648 | HIGH | 7.8 | 1.1% | Oct 14, 2026 | @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute s... |
| CVE-2026-110647 | HIGH | 7.8 | 1.0% | Oct 14, 2026 | Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands b... |
| CVE-2026-110646 | HIGH | 8.1 | 2.1% | Oct 14, 2026 | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attacke... |
| CVE-2026-110645 | CRITICAL | 9.8 | 3.2% | Oct 14, 2026 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute command... |
| CVE-2026-110644 | CRITICAL | 9.8 | 2.7% | Oct 14, 2026 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers ... |
| CVE-2026-110643 | CRITICAL | 9.8 | 2.6% | Oct 14, 2026 | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands ... |
| CVE-2026-110642 | HIGH | 7.8 | 1.1% | Oct 14, 2026 | xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to ex... |