Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownIn the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX_RING byte count overflow tpacket_snd() drains every SEND_REQUEST frame in a TX ring and aOpen the advisoryOct 19, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm_request_irq() enables the interrupt before itOpen the advisoryOct 19, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver_data before registering notification handlers Both probe paths register their notificaOpen the advisoryOct 19, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra_len overflow In ieee80211_rx_h_defragment(), fragment paOpen the advisoryOct 19, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE __hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) framOpen the advisoryOct 19, 2026
- UnknownMissing AuthorizationPatch nowKEVOct 19, 2026
- Medium5.3wuxi_wubang_security_software five-in-one_safety_production_management_information_system Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVOct 19, 2026
- UnknownModerate: hostapd security updateOpen the advisoryOct 19, 2026
- UnknownSeven Gitea API routes under (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the middleware that enforces…Open the advisoryOct 18, 2026
- UnknownDeleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap.Open the advisoryOct 18, 2026
- UnknownAdding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment.Open the advisoryOct 18, 2026
- UnknownThe visibility check of Gitea user profiles was applied to GET requests only, while (follow and unfollow) required only a signed-in user.Open the advisoryOct 18, 2026
- UnknownCreating a draft release through the API returned an list that was built from a release without an ID, which matched every attachment that was not linked to a release.Open the advisoryOct 18, 2026
- Unknownreturned the metadata of every repository a user was watching without checking that the user still had access to it.Open the advisoryOct 18, 2026
- UnknownGitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys.Open the advisoryOct 18, 2026
- UnknownThe Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did.Open the advisoryOct 18, 2026
- Unknownwas registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected.Open the advisoryOct 18, 2026
- UnknownThe Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit.Open the advisoryOct 18, 2026
- UnknownRequesting for an individual user instead of an organization made the organization home handler dereference a nil organization and panic.Open the advisoryOct 18, 2026
- UnknownThe Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking.Open the advisoryOct 18, 2026
- Critical9.1The Management Console fails to properly validate input related to the configuration of JDBC user stores.Check if you run itEPSS 0.39%Oct 18, 2026
- Low1.9A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e.Open the advisoryOct 18, 2026
- Low2.1A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- UnknownCVE-2026-98853: net: gso: limit recursive IP-in-IP segmentationOpen the advisoryOct 18, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tOpen the advisoryOct 18, 2026