Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76113 | medium | 4.3 | No | Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vu... | 2026-10-18 |
| CVE-2026-78433 | medium | 5.9 | No | Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissi... | 2026-10-18 |
| CVE-2026-78231 | medium | 5.3 | No | When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied O... | 2026-10-18 |
| CVE-2026-73814 | medium | 6.5 | No | Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. Th... | 2026-10-18 |
| CVE-2026-82715 | high | 7.9 | No | Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue... | 2026-10-18 |
| CVE-2026-84790 | not reported | — | No | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | 2026-10-18 |
| CVE-2026-85747 | medium | 6.8 | No | Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a ma... | 2026-10-18 |
| CVE-2026-73804 | high | 8.1 | No | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests sign... | 2026-10-18 |
| CVE-2026-73802 | high | 8.8 | No | Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host na... | 2026-10-18 |
| CVE-2026-73800 | high | 8.8 | No | Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target ev... | 2026-10-18 |
| CVE-2026-73539 | high | 7.5 | No | Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path b... | 2026-10-18 |
| CVE-2026-73535 | high | 8.8 | No | Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in... | 2026-10-18 |
| CVE-2026-70396 | medium | 5.4 | No | Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other reposi... | 2026-10-18 |
| CVE-2026-60021 | medium | 6.5 | No | Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation c... | 2026-10-18 |
| CVE-2026-111889 | medium | 4.3 | No | phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard tha... | 2026-10-18 |
| CVE-2026-111887 | medium | 5.3 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers... | 2026-10-18 |
| CVE-2026-111886 | medium | 6.5 | No | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authen... | 2026-10-18 |
| CVE-2026-111885 | medium | 5.5 | No | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits priv... | 2026-10-18 |
| CVE-2026-18516 | critical | 9.6 | No | An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform store... | 2026-10-18 |
| CVE-2026-107381 | medium | 6.5 | No | svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG... | 2026-10-18 |