Skip to content
OpenAdvisories

Archive

3 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /3 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.9
    CVE-2026-58424 Public exploit

    Permanent Fork PR Workflow Approval Gate Bypass

    Permanent Fork PR Workflow Approval Gate Bypass

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.0
    CVE-2026-58289 Public exploit

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 8.1
    CVE-2026-28699 Public exploit

    Gitea Basic Auth bypasses OAuth2 access token scopes

    Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.2
    CVE-2026-27771 Public exploit Scanner template

    Gitea Composer package source links use insufficient permission checks

    Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.6
    CVE-2026-22874 Public exploit

    Gitea webhook and migration allow-list filtering permits SSRF

    Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.8
    CVE-2026-20896 Public exploit Scanner template

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Medium 4.7
    CVE-2026-14620 Public exploit

    webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated fro…

    webpack-dev-server webpack-dev-server argo-workflows-ui-4.0 webpack-dev-server Wolfi npm
  • High 8.8
    CVE-2026-14459 Public exploit

    Argument Injection in TUBITAK BILGEM's pardus-software

    Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0…

    TUBITAK BILGEM Software Technologies Research Institute pardus-software
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 6.0
    CVE-2026-12960 Public exploit

    An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application …

    ASUS Router app