Security Operations
Threat Intelligence
🔎
❓

Vulnerability Intelligence

Correlated vulnerability reporting from CISA, NVD/NIST, NCSCs, MSRC and vendor advisories. Search a vendor or product - e.g. "Microsoft Exchange".
DEMO MODE
CVETitleSeverityCVSSVendor / ProductExploitationSources
CVE-2026-120306 CVE-2026-120306 - Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on t CRITICAL 9.9 Unknown 1 Details
CVE-2026-120227 CVE-2026-120227 - A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file stat CRITICAL 9.9 Unknown 1 Details
CVE-2026-120226 CVE-2026-120226 - A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by t LOW 3.3 Unknown 1 Details
CVE-2026-13575 CVE-2026-13575 - HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Sessio INFORMATIONAL - Unknown 1 Details
CVE-2026-120225 CVE-2026-120225 - A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function con CRITICAL 9.1 Unknown 1 Details
CVE-2026-120224 CVE-2026-120224 - A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run CRITICAL 9.9 Unknown 1 Details
CVE-2026-120263 CVE-2026-120263 - When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account INFORMATIONAL - Unknown 1 Details
CVE-2026-120223 CVE-2026-120223 - A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file LOW 3.1 Unknown 1 Details
CVE-2026-119627 CVE-2026-119627 - The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a INFORMATIONAL - Unknown 1 Details
CVE-2026-119625 CVE-2026-119625 - The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. INFORMATIONAL - Unknown 1 Details
CVE-2026-119533 CVE-2026-119533 - Repository and organization project boards listed the pull requests that reference each issue on the board without check INFORMATIONAL - Unknown 1 Details
CVE-2026-119441 CVE-2026-119441 - `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only re INFORMATIONAL - Unknown 1 Details
CVE-2026-118504 CVE-2026-118504 - The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST A INFORMATIONAL - Unknown 1 Details
CVE-2026-118395 CVE-2026-118395 - Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories th INFORMATIONAL - Unknown 1 Details
CVE-2026-118394 CVE-2026-118394 - The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizatio INFORMATIONAL - Unknown 1 Details
CVE-2026-118386 CVE-2026-118386 - Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork INFORMATIONAL - Unknown 1 Details
CVE-2026-117685 CVE-2026-117685 - The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, INFORMATIONAL - Unknown 1 Details
CVE-2026-117677 CVE-2026-117677 - When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.ya INFORMATIONAL - Unknown 1 Details
CVE-2026-117649 CVE-2026-117649 - The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, INFORMATIONAL - Unknown 1 Details
CVE-2026-117646 CVE-2026-117646 - The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included p INFORMATIONAL - Unknown 1 Details