CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.09)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An improper input validation vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. This can lead to remote code execution on the victim's system.
A Use-After-Free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. The issue stems from improper memory management when processing specially crafted network requests.
A vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. The issue is due to improper authorization.
A Use-After-Free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code remotely over a network.
An XSS vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network due to improper input neutralization during web page generation.
A type confusion vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code remotely over a network.
An integer overflow or wraparound vulnerability has been discovered in Microsoft Edge (Chromium-based). This flaw allows an unauthorized attacker to execute code remotely on the victim's system.
A heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code remotely over a network.
A vulnerability in Gitea up to version 1.26.1 allows Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.
A vulnerability in Gitea up to version 1.26.2 allows Git LFS object reuse, enabling users with repository access but without Code-unit access to authorize private source objects.
A stored cross-site scripting vulnerability in Gitea allows attackers to inject malicious scripts via the extensionsRequired field in glTF files rendered by the 3D file viewer. Affects versions from 1.25.0 before 1.26.0.
A vulnerability in Gitea up to version 1.26.1 allows bypassing OAuth2 access token scope enforcement via HTTP Basic authentication.
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.
In Gitea 1.25.5, a branch-specific write-permission result is cached across multiple refs in one pre-receive hook session. This allows a per-branch maintainer-edit grant to be reused for other refs, escalating to full repository write access.
A vulnerability in Gitea up to version 1.26.1 is caused by insufficient permission checks for Composer package source links. This can expose private or internal package source information.
A vulnerability in Gitea before version 1.25.5 allows draft release data or attachments to be accessed without the required write permission.
A vulnerability in Gitea before version 1.25.5 allows a user to change another user's primary email address. The issue stems from insufficient permission validation during account modification.
Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.
A vulnerability in Gitea up to version 1.26.1 allows users with the 'Allow edits from maintainers' permission to commit changes to repositories they have read-only access to but should not be able to write.
In Gitea versions before 1.25.5, insufficient visibility checks in organization permission APIs allow disclosure of hidden members and private organizations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS