| CVE-2026-71450 | NA | N/A | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and C… | 2026-11-02 |
| CVE-2026-115946 | NA | N/A | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the deco… | 2026-11-01 |
| CVE-2026-120189 | CRITICAL | 10.0 | A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_… | 2026-11-01 |
| CVE-2026-120190 | LOW | 3.5 | A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unkno… | 2026-11-01 |
| CVE-2026-120191 | HIGH | 7.3 | A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown function… | 2026-11-01 |
| CVE-2026-120243 | MEDIUM | 5.5 | FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that… | 2026-11-01 |
| CVE-2026-120244 | MEDIUM | 5.5 | FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows… | 2026-11-01 |
| CVE-2026-120245 | MEDIUM | 5.5 | FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() tha… | 2026-11-01 |
| CVE-2026-120246 | MEDIUM | 5.5 | FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks… | 2026-11-01 |
| CVE-2026-120247 | MEDIUM | 5.5 | FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that al… | 2026-11-01 |
| CVE-2026-120248 | MEDIUM | 4.8 | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office… | 2026-11-01 |
| CVE-2026-120249 | MEDIUM | 6.5 | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in t… | 2026-11-01 |
| CVE-2026-120250 | MEDIUM | 5.3 | OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_util… | 2026-11-01 |
| CVE-2026-120251 | MEDIUM | 5.5 | imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() th… | 2026-11-01 |
| CVE-2026-120252 | MEDIUM | 5.5 | imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless … | 2026-11-01 |
| CVE-2026-120192 | MEDIUM | 5.3 | A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the… | 2026-11-01 |
| CVE-2026-120195 | CRITICAL | 10.0 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is… | 2026-11-01 |
| CVE-2026-120196 | CRITICAL | 9.9 | A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file … | 2026-11-01 |
| CVE-2026-120197 | CRITICAL | 9.9 | A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /c… | 2026-11-01 |
| CVE-2026-107342 | NA | N/A | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capabi… | 2026-11-01 |
| CVE-2026-107343 | NA | N/A | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capabi… | 2026-11-01 |
| CVE-2026-113481 | NA | N/A | The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to… | 2026-11-01 |
| CVE-2026-113482 | NA | N/A | The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes befor… | 2026-11-01 |
| CVE-2026-118168 | NA | N/A | The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed hand… | 2026-11-01 |
| CVE-2026-120198 | CRITICAL | 10.0 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finis… | 2026-11-01 |
| CVE-2026-120217 | MEDIUM | 4.3 | A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of t… | 2026-11-01 |
| CVE-2026-120218 | LOW | 3.5 | A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveI… | 2026-11-01 |
| CVE-2026-112887 | NA | N/A | Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repos… | 2026-11-01 |
| CVE-2026-113429 | NA | N/A | Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the col… | 2026-11-01 |
| CVE-2026-114199 | NA | N/A | `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the tok… | 2026-11-01 |
| CVE-2026-116289 | NA | N/A | Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization… | 2026-11-01 |
| CVE-2026-116296 | NA | N/A | The API routes for releases, release assets, milestones and repository labels did not reject changes to archiv… | 2026-11-01 |
| CVE-2026-116474 | NA | N/A | The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/us… | 2026-11-01 |
| CVE-2026-117635 | NA | N/A | The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A pub… | 2026-11-01 |
| CVE-2026-117646 | NA | N/A | The repositories, stars and watching tabs of user profiles and the repository list of organization home pages … | 2026-11-01 |
| CVE-2026-117649 | NA | N/A | The issue timeline API and the web issue page hid cross-reference events that point at issues the reader canno… | 2026-11-01 |
| CVE-2026-117677 | NA | N/A | When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for… | 2026-11-01 |
| CVE-2026-117685 | NA | N/A | The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` re… | 2026-11-01 |
| CVE-2026-118386 | NA | N/A | Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, whil… | 2026-11-01 |
| CVE-2026-118394 | NA | N/A | The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public o… | 2026-11-01 |
| CVE-2026-118395 | NA | N/A | Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repos… | 2026-11-01 |
| CVE-2026-118504 | NA | N/A | The web interface blocks issue and pull request changes on archived repositories, but several issue routes of … | 2026-11-01 |
| CVE-2026-119441 | NA | N/A | `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the publ… | 2026-11-01 |
| CVE-2026-119533 | NA | N/A | Repository and organization project boards listed the pull requests that reference each issue on the board wit… | 2026-11-01 |
| CVE-2026-119625 | NA | N/A | The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking th… | 2026-11-01 |
| CVE-2026-119627 | NA | N/A | The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer co… | 2026-11-01 |
| CVE-2026-120223 | LOW | 3.1 | A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of… | 2026-11-01 |
| CVE-2026-120263 | NA | N/A | When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the lin… | 2026-11-01 |
| CVE-2026-120224 | CRITICAL | 9.9 | A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_b… | 2026-11-01 |
| CVE-2026-120225 | CRITICAL | 9.1 | A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the fu… | 2026-11-01 |