Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,852

CVE-2026-9102

Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2026-9129

Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2023-4934

IDOR in Usta AYBS

Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2023-4972

Information Disclosure in Digital Yepas

Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yepas
Products
Digital Yepas
CVE-2023-4702

Authentication Bypass in Digital Yepas

Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas: before 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yepas
Products
Digital Yepas
CVE-2023-5045

SQLi in Biltay's Kayısı

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Kayisi: before 1286.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Kayisi
CVE-2023-5046

SQLi in Biltay's Procost

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Procost
CVE-2023-5047

SQLi in DRDrive

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection. This issue affects DRDrive: before 20231006.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drd
Products
Drdrive
CVE-2023-5443

User Enumeration in EDM Informatic's E-Invoice Software

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
E-invoice Project Edm Informatics
Products
E-invoice E-invoice
CVE-2023-5570

User Enumeration in Inohom's Home Manager Gateway

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Inohom
Products
Home Manager Gateway
CVE-2026-32740

libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Struktur
Products
Libheif
CVE-2026-24160

Null Pointer Dereference Leading to Denial of Service in NVIDIA TensorRT-LLM

NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker could cause an unchecked return value to a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Tensorrt-llm Tensorrt Llm
CVE-2026-6365

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core
CVE-2026-6366

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Drupal Drupal Core