Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-120227 | High CVSS 8.6 |
- Operating systems & software |
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file… | 1 Nov 2026 |
| CVE-2026-120226 | Low CVSS 1.9 |
- Operating systems & software |
A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by… | 1 Nov 2026 |
| CVE-2026-13575 | Not yet scored | - Operating systems & software |
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in… | 1 Nov 2026 |
| CVE-2026-120225 | High CVSS 8.5 |
- Operating systems & software |
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function… | 1 Nov 2026 |
| CVE-2026-120224 | High CVSS 8.6 |
- Applications & supply chain |
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function… | 1 Nov 2026 |
| CVE-2026-120263 | Not yet scored | - Identity & access |
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the… | 1 Nov 2026 |
| CVE-2026-120223 | Low CVSS 1.3 |
- Operating systems & software |
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the… | 1 Nov 2026 |
| CVE-2026-119627 | Not yet scored | - Applications & supply chain |
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see… | 1 Nov 2026 |
| CVE-2026-119625 | Not yet scored | - Operating systems & software |
The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their… | 1 Nov 2026 |
| CVE-2026-119533 | Not yet scored | - Operating systems & software |
Repository and organization project boards listed the pull requests that reference each issue on the board without… | 1 Nov 2026 |
| CVE-2026-119441 | Not yet scored | - Applications & supply chain |
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only… | 1 Nov 2026 |
| CVE-2026-118504 | Not yet scored | - Applications & supply chain |
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST… | 1 Nov 2026 |
| CVE-2026-118395 | Not yet scored | - Applications & supply chain |
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories… | 1 Nov 2026 |
| CVE-2026-118394 | Not yet scored | - Identity & access |
The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public… | 1 Nov 2026 |
| CVE-2026-118386 | Not yet scored | - Operating systems & software |
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the… | 1 Nov 2026 |
| CVE-2026-117685 | Not yet scored | - Cloud & SaaS |
The OCI registry's cross-repository blob mount checked the target package against the token's `public-only`… | 1 Nov 2026 |
| CVE-2026-117677 | Not yet scored | - Hardware & firmware |
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for… | 1 Nov 2026 |
| CVE-2026-117649 | Not yet scored | - Applications & supply chain |
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot… | 1 Nov 2026 |
| CVE-2026-117646 | Not yet scored | - Applications & supply chain |
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included… | 1 Nov 2026 |
| CVE-2026-117635 | Not yet scored | - Applications & supply chain |
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only… | 1 Nov 2026 |
| CVE-2026-116474 | Not yet scored | - Applications & supply chain |
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user`… | 1 Nov 2026 |
| CVE-2026-116296 | Not yet scored | - Applications & supply chain |
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived… | 1 Nov 2026 |
| CVE-2026-116289 | Not yet scored | - Operating systems & software |
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions… | 1 Nov 2026 |
| CVE-2026-114199 | Not yet scored | - Applications & supply chain |
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner… | 1 Nov 2026 |
| CVE-2026-113429 | Not yet scored | - Operating systems & software |
Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that… | 1 Nov 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.