Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-15027

Changing｜CGServiSign - OS Command Injection

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

CVSS 4.0 · 8.6 High EPSS 3.2% KEV · Not listed
Vendors
Changingtec
Products
Servisign
CVE-2026-95627

Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tauri
Products
Tauri-plugin-dialog
CVE-2026-77762

Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Tomcat
CVE-2026-96609

Unbounded Ring Buffer Enables Persistent Console Loop in Robur Albatross

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Robur
Products
Albatross
CVE-2026-73858

Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Solspace
Products
Freeform
CVE-2026-96599

Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Isotope
Products
Isotope-core
CVE-2026-96600

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Isotope
Products
Isotope-core
CVE-2026-61814

Jawn: Quadratic parsing effort in AsyncParser

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Org.typelevel Typelevel
Products
Jawn-parser 2.12 Jawn-parser 2.13 Jawn-parser 3 and 1 more
CVE-2026-96872

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-94181

Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
The Browser Company Of New York
Products
Arc
CVE-2026-96770

s2s-proxy accepts untrusted client certificates

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Temporal Technologies, Inc.
Products
S2s-proxy
CVE-2026-87900

Remote Authenticated File Read and Code Execution via Argument Injection in WP Toolkit for cPanel

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Webpros
Products
Wp Toolkit For Cpanel