Export limit exceeded: 377281 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377281 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-53067 | 1 Linux | 1 Linux Kernel | 2026-08-13 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc pci_epf_alloc_doorbell() stores the allocated doorbell message array in epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation fails, the array is freed but the EPF state may still point to freed memory. Clear epf->db_msg and epf->num_db on the MSI allocation failure path so that later cleanup cannot double-free the array and callers can retry allocation. Also return -EBUSY when doorbells have already been allocated to prevent leaking or overwriting an existing allocation. | ||||
| CVE-2026-58437 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Repository Visibility Manipulation via Git Push Options | ||||
| CVE-2026-58439 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | ||||
| CVE-2026-73515 | 1 Postgis | 1 Postgis | 2026-08-13 | 8.1 High |
| PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service. | ||||
| CVE-2026-23603 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | ||||
| CVE-2026-56654 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Privilege Escalation via Access Token Scope Escalation in API | ||||
| CVE-2026-58443 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Public-only repository tokens can update private PR head branches | ||||
| CVE-2026-58445 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | ||||
| CVE-2026-19356 | 1 Mingsoft | 1 Mcms | 2026-08-13 | 5.3 Medium |
| A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19361 | 1 Macrozheng | 1 Mall | 2026-08-13 | 3.7 Low |
| A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way. | ||||
| CVE-2026-19382 | 1 Almico | 1 Speedfan | 2026-08-13 | 2.3 Low |
| A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler. Executing a manipulation can lead to memory leak. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-57894 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | ||||
| CVE-2026-58314 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Two SSRF findings in Gitea 1.26.2 | ||||
| CVE-2026-58420 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Local File Inclusion via file:// URI in Migration Restore | ||||
| CVE-2026-58442 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Repository migration SSRF via multi-answer DNS allow-list bypass | ||||
| CVE-2026-58444 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | ||||
| CVE-2026-59765 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | ||||
| CVE-2026-58417 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| REST API exposes organization membership of private organizations to public | ||||
| CVE-2026-58425 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | ||||
| CVE-2026-58428 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | ||||