Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,852

CVE-2026-41859

Missing TLS in NATS Sync Enables Credential Theft from BOSH Director

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every director call (/info, /deployments, /deployments/<name>/vms). Affected versions: - BOSH: all versions prior to v282.1.9 (inclusive); fixed in v282.1.9 or later

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Cloud Foundry
Products
Bosh
CVE-2026-10766

mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_dataframe_hash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local environment. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mlrun
Products
Mlrun
CVE-2026-43924

FOSSBilling has an open redirect via administrator-configured redirect targets

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured destination URLs before storing or issuing redirects. This allows arbitrary external URLs to be configured as redirect targets, creating an open redirect vulnerability exploitable for phishing attacks. Users following a legitimate FOSSBilling URL can be silently redirected to an attacker-controlled external site. The redirect is issued as a 301 (Moved Permanently) response, which browsers cache persistently, amplifying the impact. Exploitation requires administrator privileges to create or modify redirect entries, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 fixes the issue. Some workarounds are available. Restrict admin access to the Redirect module to trusted administrators only and/or audit existing redirect entries in the database (the `extension_meta` table with `extension = 'mod_redirect'`) for any unexpected or external target URLs.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fossbilling
Products
Fossbilling
CVE-2026-10802

keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Keystonejs
Products
Keystone
CVE-2025-14349

Business Logic Error in Universal Software's FlexCity/Kiosk

Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Functionality Not Properly Constrained by ACLs, Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Uni-yaz Universal Software Inc.
Products
Flexcity Flexcity/kiosk
CVE-2025-11960

Reflected XSS in Aryom's KVKNET

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Aryom
Products
Kvknet
CVE-2025-11962

Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Divvydrive
Products
Digital Corporate Warehouse
CVE-2025-11963

Reflected XSS in Saysis's StarCities

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Saysis
Products
Starcities
CVE-2025-12059

Improper Access Control in Logo Software's Logo j-Platform

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Logo j-Platform: from 3.29.6.4 before 3.34.8.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Logo Software Industry And Trade Inc.
Products
Logo J-platform
CVE-2025-12504

SQLi in Talent Software's UNIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL Injection. This issue affects UNIS: before 42321.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Talentsoft
Products
Unis
CVE-2025-13002

XSS in Farktor Software's E-Commerce Package

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Cross-Site Scripting (XSS). This issue affects E-Commerce Package: through 27112025.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Farktor Farktor Software E-commerce Services Inc.
Products
E-commerce Package E-commerce Package
CVE-2025-13003

IDOR in Aksis Computer's AxOnboard

Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Aksis Technology
Products
Axonboard
CVE-2025-13124

IDOR in Netiket''s ApplyLogic

Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers. This issue affects ApplyLogic: through 01.12.2025.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Netiket
Products
Applylogic
CVE-2025-13125

IDOR in Im Park's DijiDemi

Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Exploitation of Trusted Identifiers. This issue affects DijiDemi: through 28.11.2025.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Im Park
Products
Dijidemi
CVE-2025-13127

XSS in TACAS Consulting's GoldenHorn

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TAC Information Services Internal and External Trade Inc. GoldenHorn allows Cross-Site Scripting (XSS). This issue affects GoldenHorn: before 4.25.1121.1.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-13129

Business Logic Error in Seneka Software's Onaylarım

Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım allows Functionality Misuse. This issue affects Onaylarım: from 25.09.26.01 through 18112025.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Seneka
Products
Onaylarım
CVE-2025-13183

Stored XSS in Hotech's Otello

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS. This issue affects Otello: from 2.4.0 before 2.4.4.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—