by Kastro CVE-2026-20896 · Gitea Gitea Open Source Git Server
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,897 matching vulnerabilities · Page 139 of 778
Gitea
CVE-2026-20706 · Gitea Gitea Open Source Git Server
Gitea repository archive downloads bypass token scope checks
CVE-2026-22874 · Gitea Gitea Open Source Git Server
Gitea webhook and migration allow-list filtering permits SSRF
CVE-2026-58422 · Gitea Gitea Open Source Git Server
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
CVE-2026-58426 · Gitea Gitea Open Source Git Server
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
CVE-2026-26292 · Gitea Gitea Open Source Git Server
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
CVE-2026-27780 · Gitea Gitea Open Source Git Server
Gitea pre-receive hook can miss branch-protection checks after scanner errors
CVE-2026-25718 · Gitea Gitea Open Source Git Server
Gitea template repository generation mishandles symlinked paths
CVE-2026-22547 · Gitea Gitea Open Source Git Server
Gitea repository creation accepts invalid field values
CVE-2026-26232 · Gitea Gitea Open Source Git Server
Gitea OAuth2 authorization codes lack expiry and reuse enforcement
CVE-2026-26247 · Gitea Gitea Open Source Git Server
Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
curl
CVE-2026-8925 · curl curl
SASL double-free
CVE-2026-9079 · curl curl
stale proxy password leak
CVE-2026-11856 · curl curl
cross-origin Digest auth state leak
CVE-2026-10536 · curl curl
HTTP/2 stream-dependency tree UAF
CVE-2026-8924 · curl curl
trailing dot domain super cookie
CVE-2026-11564 · curl curl
Native CA trust persist
CVE-2026-8927 · curl curl
env-set cross-proxy Digest auth state leak
CVE-2026-8926 · curl curl
password leak with netrc and user in URL
Guangzhou Red Sea Cloud Computing Co., Ltd.
CVE-2024-14037 · Guangzhou Red Sea Cloud Computing Co., Ltd. Red Sea Cloud eHR
Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
keras-team
CVE-2026-12481 · keras-team keras-team/keras
Deserialization of Untrusted Data in keras-team/keras
leshchenko1979
CVE-2026-52830 · leshchenko1979 fast-mcp-telegram
fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
Notifiarr
apereo
Ubiquiti Inc
CVE-2026-50746 · Ubiquiti Inc UniFi Connect Application
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to…
CVE-2026-50748 · Ubiquiti Inc UniFi Access Application
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi A…
CVE-2026-54402 · Ubiquiti Inc UniFi OS Server
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi O…
CVE-2026-54408 · Ubiquiti Inc UniFi Protect Application
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to…
CVE-2026-50747 · Ubiquiti Inc UniFi Talk Application
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities fou…
CVE-2026-55115 · Ubiquiti Inc UniFi Protect Application
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Appli…
CVE-2026-55116 · Ubiquiti Inc Dream Machines
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerabil…
CVE-2026-54400 · Ubiquiti Inc UniFi Access Application
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Ac…
Yonyou Network Technology Co., Ltd.
CVE-2022-50973 · Yonyou Network Technology Co., Ltd. KSOA
Yonyou KSOA 9.0 Unauthenticated File Upload RCE via ImageUpload Servlet
Microsoft
CVE-2026-58289 · Microsoft Microsoft Edge (Chromium-based)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-45499 · Microsoft Azure Open AI
Azure OpenAI Elevation of Privilege Vulnerability
CVE-2026-57100 · Microsoft Microsoft Entra Provisioning Service
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
CVE-2026-26145 · Microsoft Azure Synapse
Microsoft Azure Synapse Elevation of Privilege Vulnerability
CVE-2026-57983 · Microsoft Microsoft Edge (Chromium-based)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2026-41106 · Microsoft Microsoft 365 Copilot
Microsoft 365 Copilot Elevation of Privilege Vulnerability
EstrellaXD
printcart
CVE-2026-9725 · printcart Printcart Web to Print Product Designer for WooCommerce
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
juicedata
openSUSE
CVE-2026-56004 · openSUSE buildservice
obs-service-tar_scm: command injection via mercurial handler
WatchGuard
Apache Software Foundation
CVE-2026-47898 · Apache Software Foundation Apache Lucene.Net
Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
CPANSec
Raera - Ankara Web Design and Digital Advertising Agency
CVE-2026-4321 · Raera - Ankara Web Design and Digital Advertising Agency Destekz