NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-105811 Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aw... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-104046 A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain... 2026-10-06 6.2 LOCAL MEDIUM NVD
CVE-2026-104045 A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchrono... 2026-10-06 4.7 LOCAL MEDIUM NVD
CVE-2026-101258 A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrar... 2026-10-06 7.8 LOCAL HIGH NVD
CVE-2026-96589 When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can r... 2026-10-06 4.3 NETWORK MEDIUM NVD
CVE-2026-96580 Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull re... 2026-10-06 7.5 NETWORK HIGH NVD
CVE-2026-96404 When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submit... 2026-10-06 8.1 NETWORK HIGH NVD
CVE-2026-96400 With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved... 2026-10-06 4.3 NETWORK MEDIUM NVD
CVE-2026-96399 A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered... 2026-10-06 7.5 NETWORK HIGH NVD
CVE-2026-95112 When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown li... 2026-10-06 6.5 NETWORK MEDIUM NVD
CVE-2026-95106 Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such ... 2026-10-06 9.1 NETWORK CRITICAL NVD
CVE-2026-94205 Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. F... 2026-10-06 9.8 NETWORK CRITICAL NVD
CVE-2026-94114 Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requeste... 2026-10-06 5.9 NETWORK MEDIUM NVD
CVE-2026-89430 Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization... 2026-10-06 8.1 NETWORK HIGH NVD
CVE-2026-79960 When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline eva... 2026-10-06 7.1 NETWORK HIGH NVD