Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-47067

Atom table exhaustion via unrecognized URL schemes in hackney

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackney_url.erl converts every unrecognized URL scheme to a permanent BEAM atom via binary_to_atom/2. BEAM atoms are never garbage-collected and the atom table defaults to a hard limit of 1,048,576 entries. An attacker who can supply URLs with attacker-chosen scheme prefixes — directly as request targets, as configured webhook URLs, or via Location headers followed during redirects — can exhaust the atom table and crash the entire BEAM VM with system_limit. This issue affects hackney: from 2.0.0 before 4.0.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Benoitc
Products
Hackney
CVE-2026-47076

SSRF allowlist bypass via percent-encoded host in hackney

Interpretation Conflict vulnerability in benoitc hackney allows Server Side Request Forgery. hackney_url:normalize/2 URL-decodes the host component after the URL has been parsed into a #hackney_url{} record. OTP's uri_string:parse/1 and inet:parse_address/1 do not decode percent-escapes in the host, so a URL such as http://%31%32%37%2E%30%2E%30%2E%31/ is seen by a caller's allowlist validator with host %31%32%37%2E%30%2E%30%2E%31 (not an IP address), which passes the allowlist check. hackney's normalizer then decodes the host to 127.0.0.1 and opens a TCP connection to loopback. Because hackney:request/5 always calls hackney_url:normalize/2 with no opt-out, every request that takes a binary or list URL is affected. The same technique reaches cloud instance metadata services (169.254.169.254), RFC1918 networks, and any admin interface listening on localhost. This issue affects hackney: from 0.13.0 before 4.0.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Benoitc
Products
Hackney
CVE-2025-13755

IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2026-9299

omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption

A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and may be used. Applying a patch is the recommended action to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Omec-project
Products
Amf
CVE-2026-24212

Sensitive Information Exfiltration in NVIDIA Isaac Launchable Leading to Possible Code Execution

NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Isaac Launchable
CVE-2026-43981

Algernon: Race Condition in handle() shared LState

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Xyproto
Products
Algernon
CVE-2026-9295

Edimax BR-6428NS POST Request formWirelessTbl buffer overflow

A security flaw has been discovered in Edimax BR-6428NS 1.10. This affects the function formWirelessTbl of the file /goform/formWirelessTbl of the component POST Request Handler. Performing a manipulation of the argument vapurl results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Edimax
Products
Br-6428ns Br-6428ns Firmware
CVE-2026-47716

Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This vulnerability is fixed in 2.2.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Bugsink
Products
Bugsink
CVE-2026-28807

Path Traversal in wisp.serve_static allows arbitrary file read

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.serve_static function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded sequence %2e%2e passes through string.replace unchanged, then uri.percent_decode converts it to .., which the OS resolves as directory traversal when the file is read. An unauthenticated attacker can read any file readable by the application process in a single HTTP request, including application source code, configuration files, secrets, and system files. This issue affects wisp: from 2.1.1 before 2.2.1.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed
Vendors
Gleam-wisp
Products
Wisp
CVE-2026-25900

Joomla! Core - [20260501] - XSS in feed modules

Lack of output escaping leads to a XSS vector in the feed modules.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-25901

Joomla! Core - [20260502] - XSS in com_associations

Lack of output escaping leads to a XSS vector in the multilingual associations component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2026-49002

Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product

Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access system data beyond their permissions, such as viewing and modifying configuration information.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zxunipos Nds-lte
CVE-2025-7024

Local privilege escalation in Windows Server OS through installed Tetra Connectivity Server (TCS)

Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbitrary code with SYSTEM privileges if a user is tricked or directed to place a crafted file into the vulnerable directory. This issue affects TETRA connectivity Server: 7.0. Vulnerability fix is available and delivered to impacted customers.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Airbus Microsoft
Products
Tetra Connectivity Server Tetra Connectivity Server (tcs) Windows
CVE-2026-49001

Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product

Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, inducing the execution of unintended operations such as tampering with configuration data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zxunipos Nds-lte
CVE-2026-9608

QianFox FoxCMS Administrator Backend edit cross site scripting

A vulnerability was determined in QianFox FoxCMS up to 1.2.6. The impacted element is an unknown function of the file /Tag/edit of the component Administrator Backend. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Qianfox
Products
Foxcms
CVE-2022-27794

Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability

Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by the use of a variable that has not been initialized when processing of embedded fonts, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file

CVSS 3.1 · 7.8 High EPSS 14.3% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Acrobat Acrobat Dc Acrobat Reader and 3 more
CVE-2026-30895

Joomla! Core - [20260504] - XSS in readmore links

Lack of output escaping leads to a XSS vector in the readmore links for com_content.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomla
Products
Joomla! Joomla\!
CVE-2022-27800

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of annotations that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.0 · 7.8 High EPSS 4.1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Acrobat Acrobat Dc Acrobat Reader and 3 more
CVE-2026-41148

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector and turns everything after it into a new CSS rule on the page. This enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mermaid Project
Products
Mermaid