CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120223Oray Pugongying X5 Pro Session ID session.lua session_get random valuesOray Pugongying X5 Pro
- CVE-2026-119627Gitea limited-visibility profile disclosure with public-only tokensGitea
- CVE-2026-119625Gitea user and organization feed token scope bypassGitea
- CVE-2026-119533Gitea private pull request disclosure on project boardsGitea
- CVE-2026-119441Gitea public-only token bypass on bulk organization repository deletionGitea
- CVE-2026-118504Gitea issue changes on archived repositories through the APIGitea
- CVE-2026-118395Gitea public-only token bypass in repository and organization creationGitea
- CVE-2026-118394Gitea OAuth2 userinfo private group disclosure to public-only tokensGitea
- CVE-2026-117685Gitea public-only package token access to private OCI blobsGitea
- CVE-2026-117677Gitea Helm chart upload decompression denial of serviceGitea
- CVE-2026-117649Gitea private issue disclosure through issue dependency timeline eventsGitea
- CVE-2026-117646Gitea private repository listing to public-only tokens on profilesGitea
- CVE-2026-117635Gitea admin API public-only token scope bypassGitea
- CVE-2026-116474Gitea Actions job token spoofing of instance-signed commitsGitea
- CVE-2026-116296Gitea archived repository release, milestone and label modificationGitea
- CVE-2026-116289Gitea public-only token bypass through Actions runner registrationGitea
- CVE-2026-114199Gitea contribution heatmap private activity disclosure to public-only tokensGitea
- CVE-2026-113429Gitea stored XSS through legacy Actions artifact Content-EncodingGitea
- CVE-2026-112887Gitea Actions task token private repository enumerationGitea
- CVE-2026-120263Gitea OAuth2 account auto-linking takeover through the sign-up formGitea
- CVE-2026-118386Gitea Actions fork workflow trust through pull request review commitGitea
- CVE-2026-120218Typemill SvgSanitizer.php saveImage cross site scriptingTypemill
- CVE-2026-120217Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redosDelgan loguru
- CVE-2026-118168MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address DisclosureMapPress
- CVE-2026-113482Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode AttributeMedia Library Assistant
- CVE-2026-113481Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fieldsMedia Library Assistant
- CVE-2026-107343Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender SpoofingKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-107342Kali Forms < 2.4.30 - Subscriber+ User Email Address DisclosureKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-120198WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injectionWAVLINK WL-WN530BE1-A
- CVE-2026-120197WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injectionWAVLINK WL-WN530HG4B