Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-94274

YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103547

LDAP Authentication Bypass via Reused File Descriptor and Message ID in OpenBSD ldapd

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openbsd
CVE-2026-69277

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-96428

Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96429

Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96430

Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96431

Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96440

Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-76718

HPE OneView - Cross-site scripting vulnerability

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise
Products
Hpe Oneview
CVE-2026-76719

HPE OneView - Cross-site scripting vulnerability

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise
Products
Hpe Oneview
CVE-2026-15390

Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Denx Software Engineering
Products
Das U-boot
CVE-2026-85520

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mypresta
Products
Google Merchant Center Feed
CVE-2026-87748

Privilege Escalation via Account Takeover in Interprobe's Qorela DC

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Interprobe Information Technologies Inc.
Products
Qorela Dc
CVE-2026-102437

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Esengine
Products
Deepseek-reasonix
CVE-2026-82973

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Psyb0t
Products
Docker-mailbox
CVE-2026-102360

lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dmonad
Products
Lib0