2026 CVEs (page 388)
Page 388 of 686 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58424 | High | 8.9 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass |
CVE-2026-58423 | High | 7.7 | 2026-07-03 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories |
CVE-2026-58422 | Critical | 9.8 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts |
CVE-2026-58421 | High | 7.5 | 2026-07-03 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service |
CVE-2026-58419 | High | 7.5 | 2026-07-03 | Notification API leaks private issue metadata after access revocation |
CVE-2026-58418 | Medium | 6.5 | 2026-07-03 | SSRF via HTTP Redirect in Repository Migration |
CVE-2026-58300 | Medium | 6.2 | 2026-07-03 | Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-58299 | High | 7.5 | 2026-07-03 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network. |
CVE-2026-58298 | High | 7.2 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-58297 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58296 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58295 | High | 8.3 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature o… |
CVE-2026-58294 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58293 | High | 8.1 | 2026-07-03 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58292 | High | 7.5 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58291 | Medium | 6.1 | 2026-07-03 | Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-58290 | High | 7.5 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58289 | Critical | 9.0 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58288 | High | 8.3 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58287 | High | 8.3 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58286 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58285 | High | 8.3 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58284 | High | 8.3 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-58283 | High | 8.1 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-58282 | High | 8.1 | 2026-07-03 | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58278 | Medium | 5.4 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-58276 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57993 | High | 7.4 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-57992 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57991 | High | 7.4 | 2026-07-03 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over… |
CVE-2026-57988 | High | 7.1 | 2026-07-03 | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57987 | Medium | 6.5 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-57986 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57985 | High | 7.6 | 2026-07-03 | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57984 | High | 7.5 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57983 | High | 8.7 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-57981 | High | 8.8 | 2026-07-03 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57977 | High | 7.1 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perf… |
CVE-2026-57975 | High | 7.5 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-57974 | High | 8.8 | 2026-07-03 | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-56646 | Medium | 6.5 | 2026-07-03 | Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a networ… |
CVE-2026-56645 | High | 8.8 | 2026-07-03 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-55945 | Medium | 4.2 | 2026-07-03 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to… |
CVE-2026-45489 | Medium | 6.5 | 2026-07-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2026-45488 | Medium | 5.4 | 2026-07-03 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2026-28744 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks. |
CVE-2026-28740 | High | 7.1 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-uni… |
CVE-2026-28737 | High | 8.7 | 2026-07-03 | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer. |
CVE-2026-28705 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names… |
CVE-2026-28699 | High | 8.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication. |
CVE-2026-27783 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. |
CVE-2026-27780 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-prot… |
CVE-2026-27779 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation. |
CVE-2026-27775 | High | 8.8 | 2026-07-03 | Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant… |
CVE-2026-27771 | High | 8.2 | 2026-07-03 | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package s… |
CVE-2026-27761 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing private repository com… |
CVE-2026-27660 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission. |
CVE-2026-27657 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. |
CVE-2026-26307 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources. |
CVE-2026-26292 | Critical | 9.8 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot… |
CVE-2026-26247 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected… |
CVE-2026-26232 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. |
CVE-2026-26231 | High | 8.5 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read bu… |
CVE-2026-25782 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to… |
CVE-2026-25779 | Medium | 6.1 | 2026-07-03 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values. |
CVE-2026-25718 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked o… |
CVE-2026-25714 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE… |
CVE-2026-25712 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations. |
CVE-2026-25038 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. |
CVE-2026-24690 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. |
CVE-2026-24451 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be… |
CVE-2026-22874 | Critical | 9.6 | 2026-07-03 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering. |
CVE-2026-22555 | High | 8.1 | 2026-07-03 | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organ… |
CVE-2026-22547 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object for… |
CVE-2026-20909 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries. |
CVE-2026-20896 | Critical | 9.8 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when revers… |
CVE-2026-20779 | High | 7.1 | 2026-07-03 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-fa… |
CVE-2026-20706 | Critical | 9.1 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint. |
CVE-2026-14611 | Medium | 4.3 | 2026-07-03 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts… |
CVE-2026-14610 | Medium | 5.3 | 2026-07-03 | A flaw has been found in Open Asset Import Library Assimp up to 6.0.5. Impacted is the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/C… |
CVE-2026-14609 | Medium | 5.6 | 2026-07-03 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The m… |
CVE-2026-14355 | Medium | 5.6 | 2026-07-03 | In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extensi… |
CVE-2026-12481 | Critical | 9.8 | 2026-07-03 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Speci… |
CVE-2026-14608 | Medium | 4.3 | 2026-07-03 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown… |
CVE-2026-14607 | Medium | 5.5 | 2026-07-03 | A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipu… |
CVE-2026-14606 | High | 7.8 | 2026-07-03 | A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL… |
CVE-2026-14605 | High | 7.8 | 2026-07-03 | A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/l… |
CVE-2026-58379 | High | 7.3 | 2026-07-03 | A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code ex… |
CVE-2026-14604 | Medium | 6.3 | 2026-07-03 | A vulnerability was determined in Open Asset Import Library Assimp up to 6.0.4. Affected is the function Assimp::Exporter::ExportToBlob of the file code/AssetL… |
CVE-2026-14631 | Medium | 5.3 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malfor… |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |
CVE-2026-14615 | Medium | 4.3 | 2026-07-03 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system… |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-14613 | Medium | 4.3 | 2026-07-03 | A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have ac… |
CVE-2026-14612 | Medium | 4.2 | 2026-07-03 | Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized r… |
CVE-2026-53478 | High | 7.2 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-49815 | High | 7.2 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-49814 | High | 7.2 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-49813 | Medium | 6.7 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-14460 | High | 8.8 | 2026-07-03 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects p… |