Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119627 | Not yet scored | - Applications & supply chain |
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see… | 1 Nov 2026 |
| CVE-2026-119441 | Not yet scored | - Applications & supply chain |
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only… | 1 Nov 2026 |
| CVE-2026-118504 | Not yet scored | - Applications & supply chain |
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST… | 1 Nov 2026 |
| CVE-2026-118395 | Not yet scored | - Applications & supply chain |
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories… | 1 Nov 2026 |
| CVE-2026-117649 | Not yet scored | - Applications & supply chain |
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot… | 1 Nov 2026 |
| CVE-2026-117646 | Not yet scored | - Applications & supply chain |
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included… | 1 Nov 2026 |
| CVE-2026-117635 | Not yet scored | - Applications & supply chain |
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only… | 1 Nov 2026 |
| CVE-2026-116474 | Not yet scored | - Applications & supply chain |
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user`… | 1 Nov 2026 |
| CVE-2026-116296 | Not yet scored | - Applications & supply chain |
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived… | 1 Nov 2026 |
| CVE-2026-114199 | Not yet scored | - Applications & supply chain |
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner… | 1 Nov 2026 |
| CVE-2026-112887 | Not yet scored | - Applications & supply chain |
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,… | 1 Nov 2026 |
| CVE-2026-115946 | Not yet scored | - Applications & supply chain |
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.… | 1 Nov 2026 |
| CVE-2026-78189 | Not yet scored | - Applications & supply chain |
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in… | 31 Oct 2026 |
| CVE-2026-119341 | Not yet scored | - Applications & supply chain |
Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an… | 30 Oct 2026 |
| CVE-2026-46300 Exploited |
Not yet scored | Linux Kernel Applications & supply chain |
Linux Kernel Missing Initialization of a Variable Vulnerability | 28 Oct 2026 |
| CVE-2026-109618 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Memory Corruption Vulnerability | 26 Oct 2026 |
| CVE-2026-109619 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Stale Internal Request-State Vulnerability | 26 Oct 2026 |
| CVE-2026-114625 Exploited |
Not yet scored | Arista VeloCloud Orchestrator Applications & supply chain |
Arista VeloCloud Orchestrator SQL Injection Vulnerability | 23 Oct 2026 |
| CVE-2026-96654 Exploited |
Not yet scored | Plex Media Server Applications & supply chain |
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | 20 Oct 2026 |
| CVE-2026-21589 Exploited |
Not yet scored | Atlassian Multiple Products Applications & supply chain |
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | 15 Oct 2026 |
| CVE-2026-105133 Exploited |
Not yet scored | Ahsay AhsayCBS Applications & supply chain |
Ahsay AhsayCBS Improper Authentication Vulnerability | 14 Oct 2026 |
| CVE-2026-105134 Exploited |
Not yet scored | Ahsay AhsayCBS Applications & supply chain |
Ahsay AhsayCBS Command Injection Vulnerability | 14 Oct 2026 |
| CVE-2026-87902 Exploited |
Not yet scored | WordPress Core Applications & supply chain |
WordPress Core Remote File Inclusion Vulnerability | 25 Sep 2026 |
| CVE-2026-87886 Exploited |
Not yet scored | Acronis Backup Applications & supply chain |
Acronis Backup Incorrect Default Permissions Vulnerability | 16 Sep 2026 |
| CVE-2026-85706 Exploited |
Not yet scored | GitLab Community Edition and Enterprise Edition Applications & supply chain |
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | 11 Sep 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.