CVE Database
Synced from NVD, cross-referenced against CISA KEV and EPSS · ordered by last update
| CVE ID | Score | Description |
|---|---|---|
| Exploit 4h ago | 7.5 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC). |
| Exploit 4h ago | 7.5 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). |
| Exploit 4h ago | 7.1 | A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters. |
| Exploit 4h ago | 7.5 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata |
| Exploit 4h ago | 4.3 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads |
| 4h ago | 8.8 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592. |
| Exploit 4h ago | 2.7 | Webhook Authorization Header Returned in Plaintext via API |
| Exploit 4h ago | 4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
| Exploit 4h ago | 9.1 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) |
| Exploit 4h ago | 5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint |
| Exploit 4h ago | 2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
| Exploit 4h ago | 4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents |
| Exploit 4h ago | 9.1 | Public-only repository tokens can update private PR head branches |
| Exploit 4h ago | 6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass |
| Exploit 4h ago | 6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL |
| Exploit 4h ago | 6.8 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) |
| Exploit 4h ago | 8.1 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag |
| Exploit 4h ago | 7.5 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access |
| Exploit 4h ago | 7.1 | Repository Visibility Manipulation via Git Push Options |
| Exploit 4h ago | 7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests |
| Exploit 4h ago | 5.4 | Gitea LFS Deploy-Key Privilege Escalation |
| Exploit 4h ago | 7.5 | Private Repository Metadata Remains Accessible After Access Revocation |
| Exploit 4h ago | 9.1 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting |
| Exploit 4h ago | 5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea |
| Exploit 4h ago | 4.3 | Public-only API token restriction is not enforced on team API routes |
| Exploit 4h ago | 4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints |
| Exploit 4h ago | 6.5 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) |
| Exploit 4h ago | 7.5 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
| Exploit 4h ago | 4.3 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
| Exploit 4h ago | 4.4 | Local File Inclusion via file:// URI in Migration Restore |