Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420867 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116474 | 1 Gitea | 1 Gitea | 2026-11-06 | 6.5 Medium |
| The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users. | ||||
| CVE-2026-116296 | 1 Gitea | 1 Gitea | 2026-11-06 | 6.5 Medium |
| The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download URLs, delete releases and tags, and create, edit or delete milestones and labels of a repository that is meant to be read-only. Changing requests on these routes now return 423 Locked for archived repositories. | ||||
| CVE-2026-116289 | 1 Gitea | 1 Gitea | 2026-11-06 | 9.1 Critical |
| Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with `write:organization` that belongs to an owner of a public organization, an attacker could register an organization-level runner and receive jobs of the organization's private repositories that have Actions enabled, including the workflow content, Actions secrets and variables, and a task token with access to the private repository. The issue widens what the restricted token can reach; it gives nothing beyond what the owner's full account can already do. | ||||
| CVE-2026-114536 | 1 Drupal | 1 Uswds Paragraph Components | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3. | ||||
| CVE-2026-114535 | 1 Drupal | 1 Swiper Formatter | 2026-11-06 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | ||||
| CVE-2026-114534 | 1 Drupal | 1 Block Attributes | 2026-11-06 | 5.9 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0. | ||||
| CVE-2026-114533 | 1 Drupal | 1 Ágora Transparency Theme | 2026-11-06 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3. | ||||
| CVE-2026-114532 | 1 Drupal | 1 Ui Icons | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | ||||
| CVE-2026-114531 | 1 Drupal | 1 Swiper Formatter | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | ||||
| CVE-2026-114530 | 1 Drupal | 1 Dopup | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | ||||
| CVE-2026-114529 | 1 Drupal | 1 Csv Field | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7. | ||||
| CVE-2026-114528 | 1 Drupal | 1 Zero Point | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114527 | 1 Drupal | 1 Ui Icons | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | ||||
| CVE-2026-114526 | 1 Drupal | 1 Black Hole | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114525 | 1 Drupal | 1 Abc | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-114524 | 1 Drupal | 1 Custom Formatters | 2026-11-06 | 7.2 High |
| Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1. | ||||
| CVE-2026-114523 | 1 Drupal | 1 Ffmpeg Image Toolkit | 2026-11-06 | 9.8 Critical |
| Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-114199 | 1 Gitea | 1 Gitea | 2026-11-06 | 5.3 Medium |
| `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets that stem from that user's activity in private repositories. Repository names and contents were not disclosed. For public-only tokens the heatmap now only counts activity visible to anonymous users. | ||||
| CVE-2026-113429 | 1 Gitea | 1 Gitea | 2026-11-06 | 5.4 Medium |
| Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could upload an artifact that a browser renders as HTML on the Gitea origin when the direct artifact download URL is opened, and the URL is reachable anonymously on public repositories. A victim who opens the link runs the attacker's script with their own session, which for an administrator means control of the instance. Legacy uploads now store only the `gzip` marker, and the special serve headers are chosen only for valid media types. | ||||
| CVE-2026-112887 | 1 Gitea | 1 Gitea | 2026-11-06 | 4.3 Medium |
| Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts. | ||||