Export limit exceeded: 364122 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 364122 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (364122 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-26292 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 9.8 Critical |
| Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests. | ||||
| CVE-2026-27657 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 7.5 High |
| Gitea versions before 1.25.5 allow a user to change another user's primary email address. | ||||
| CVE-2026-27660 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 7.5 High |
| Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. | ||||
| CVE-2026-27761 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 4.3 Medium |
| Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository commit data to tokens without the required repository scope. | ||||
| CVE-2026-27771 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | N/A |
| Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. | ||||
| CVE-2026-28705 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 5.3 Medium |
| Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths. | ||||
| CVE-2026-28737 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 8.7 High |
| Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. | ||||
| CVE-2026-28740 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-07-07 | 7.1 High |
| Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access. | ||||
| CVE-2025-71364 | 2 Mmaitre314, Picklescan | 2 Picklescan, Picklescan | 2026-07-07 | 8.1 High |
| picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded. | ||||
| CVE-2025-71375 | 1 Mmaitre314 | 1 Picklescan | 2026-07-07 | 8.1 High |
| picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load(). | ||||
| CVE-2025-53827 | 1 Owncloud | 1 Owncloud | 2026-07-07 | 9.1 Critical |
| ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3. | ||||
| CVE-2026-41514 | 1 Op-tee | 1 Op-tee Os | 2026-07-07 | 2.5 Low |
| OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.5.0 and prior to version 4.11.0, the RSA-OAEP decryption implementation in the Hisilicon HPRE crypto driver uses non-constant-time `memcmp()` for label hash verification and has multiple distinguishable error paths. This creates a Manger-style padding oracle that allows an attacker to recover RSA-OAEP plaintext with approximately 1000-2000 adaptive chosen ciphertext queries. Only affects plat-d06 with `CFG_HISILICON_ACC_V3=y`, which seems to be disabled by default. Version 4.11.0 contains a patch. As a workaround, disable Hisilicon HPRE RSA driver with `CFG_HISILICON_ACC_V3=n`. | ||||
| CVE-2026-50134 | 1 Gohugo | 1 Hugo | 2026-07-07 | N/A |
| Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0. | ||||
| CVE-2026-50135 | 2026-07-07 | N/A | ||
| Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0. | ||||
| CVE-2026-13778 | 1 Google | 1 Chrome | 2026-07-07 | 7.8 High |
| Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical) | ||||
| CVE-2026-48588 | 1 Djangoproject | 1 Django | 2026-07-07 | 4.2 Medium |
| An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue. | ||||
| CVE-2026-53878 | 1 Djangoproject | 1 Django | 2026-07-07 | 6.1 Medium |
| An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValidator` does not prohibit newlines in domain names (unless used via a form field, since `CharField` strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because `HttpResponse` prohibits newlines in HTTP headers. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy for reporting this issue. | ||||
| CVE-2026-13851 | 1 Google | 1 Chrome | 2026-07-07 | 9.1 Critical |
| Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-44938 | 1 Suse | 1 Rancher | 2026-07-07 | 8.8 High |
| A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block. | ||||
| CVE-2026-56811 | 1 Phoenixframework | 1 Phoenix | 2026-07-07 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport (WebSocket or LongPoll). This vulnerability is associated with program files lib/phoenix/socket.ex and program routine 'Elixir.Phoenix.Socket':handle_in/4. Phoenix transports do not limit the number of channels that a single transport process may join. Every phx_join message a client sends over one connection starts a persistent channel process, and the socket process accepts an unbounded number of them. A single unauthenticated client can therefore open one WebSocket or LongPoll connection and stream a large number of phx_join messages, spawning hundreds of thousands of channel processes over that one connection and eventually reaching the BEAM maximum process limit. Once the process table is exhausted the virtual machine can no longer start new processes, denying service to legitimate traffic across the whole node. Because the amplification happens inside a single connection, network-layer connection caps and rate limiting do not mitigate it. The fix adds a :max_channels_per_transport option (default 100) that bounds the number of channels a single transport process can join, forcing abusive clients to open many connections instead, where external load balancers and reverse proxies can throttle them. This issue affects phoenix: from 0.11.0 before 1.5.15, from 1.6.0-rc.0 before 1.6.17, from 1.7.0-rc.0 before 1.7.24, and from 1.8.0-rc.0 before 1.8.9. | ||||