Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,860

CVE-2026-40549

Cross-Site Request Forgery in SOPlanning

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40548

Unrestricted Upload of File with Dangerous Type in SOPlanning

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12367

Information Disclosure in Vegagrup Software's Vega Master

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vegagrup
Products
Vega Master
CVE-2026-40547

Path Traversal in SOPlanning

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40546

Multiple SQL Injections in SOPlanning

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40545

Reflected XSS in SOPlanning

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12604

Improper Authentication in Tapandsign Technologies Tap and Sign App

Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse. This issue affects Tap&Sign App: before V.1.025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tapandsign
Products
Tap\&sign
CVE-2024-12651

Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12796

Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Holistic It
Products
Workcube Erp
CVE-2024-12913

SQLi in Megatek Communication System's Azora Wireless Network Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Megatek Communication System Azora Wireless Network Management allows SQL Injection. This issue affects Azora Wireless Network Management: through 20250916.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12914

XSS in Akinsoft's QR Menu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akınsoft QR Menü allows Cross-Site Scripting (XSS). This issue affects QR Menü: from s1.05.05 before v1.05.12.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Akinsoft
Products
Qr Menu
CVE-2026-49368

Stored Cross‑Site Scripting in JetBrains YouTrack Notification Templates

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2024-12915

Reflected XSS in Devinim Software's Modified Koha Library Software

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS. This issue affects Library Software: before 24.11.02.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-49369

Information Disclosure on Users and Groups Pages in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2024-12916

SQLi in Agito Computer's Life4All

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue affects Life4All: before 10.01.2025.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-5747

Out-of-bounds Write in Firecracker virtio-pci Transport

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Firecracker Firecracker
CVE-2026-49370

YouTrack Information Disclosure via fetchApp Requests

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-10180

TRENDnet TEW-432BRP formSysCmd command injection

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSysCmd of the file /goform/formSysCmd. Such manipulation of the argument sysCmd leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Trendnet
Products
Tew-432brp
CVE-2024-12917

Improper Access Control in Agito Computer's Health4All

Files or Directories Accessible to External Parties vulnerability in Agito Computer Health4All allows Exploiting Incorrectly Configured Access Control Security Levels, Authentication Abuse. This issue affects Health4All: before 10.01.2025.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12918

SQLi in Agito Computer's Health4All

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This issue affects Health4All: before 10.01.2025.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—