CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-112062

    🚨 CVE-2026-112062 lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to...

  • CVE-2026-112063

    🚨 CVE-2026-112063 libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to...

  • CVE-2026-110024

    🚨 CVE-2026-110024 @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the...

  • CVE-2024-4457

    🚨 CVE-2024-4457 The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an...

  • CVE-2026-104627

    🚨 CVE-2026-104627 The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that...

  • CVE-2026-105661

    🚨 CVE-2026-105661 Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler...

  • CVE-2026-105964

    🚨 CVE-2026-105964 The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run...

  • CVE-2026-107618

    🚨 CVE-2026-107618 `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a...

  • CVE-2026-107686

    🚨 CVE-2026-107686 The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without...

  • CVE-2026-109553

    🚨 CVE-2026-109553 Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal...

  • CVE-2026-109844

    🚨 CVE-2026-109844 `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user...

  • CVE-2026-110311

    🚨 CVE-2026-110311 Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched...

  • CVE-2026-110324

    🚨 CVE-2026-110324 The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow)...

  • CVE-2026-110494

    🚨 CVE-2026-110494 Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an...

  • CVE-2026-97204

    🚨 CVE-2026-97204 Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two...

  • CVE-2026-97859

    🚨 CVE-2026-97859 Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys...

  • CVE-2026-112111

    🚨 CVE-2026-112111 The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent]...

  • CVE-2026-112112

    🚨 CVE-2026-112112 An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec...

Статистика статей

Статьи
53,084
Просмотры
234,256
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.
Назад
Сверху