CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58437

Repository Visibility Manipulation via Git Push Options...

CVE-2026-58439

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-58420

Local File Inclusion via file:// URI in Migration Restore...

CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58429

Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-58417

REST API exposes organization membership of private organizations to public...

CVE-2026-58425

OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...

CVE-2026-58428

Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...

CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content...

CVE-2026-55987

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-56654

Privilege Escalation via Access Token Scope Escalation in API...

CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

CVE-2026-56657

Gitea SSH Key Parser Denial of Service...

CVE-2026-56755

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-55982

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55986

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55984

Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service...

CVE-2026-55402

CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57. Attackers with an ‘in the middle’ position can send specially crafted data to a server causing a persistent denial of service...

CVE-2026-50105

RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...

CVE-2026-24791

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-42931

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...

CVE-2026-24059

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2022-4993

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

CVE-2026-73670

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73671

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73576

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73574

In Zimbra Collaboration before 10.1.17, a local file inclusion LFI vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorize...

CVE-2026-73575

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-73571

An authorization bypass vulnerability exists in Zimbra Collaboration ZCS before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without...

CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73559

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded liststr or listlistint, prompttoseq in vllm/renderers/inputs/preprocess.py and...

CVE-2026-73514

The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-55400

CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57. Attackers with an authenticated session can send specially crafted traffic to a server in a non-default configuration and cause a persistent denial of service...

CVE-2026-55401

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful...

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...