Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2026-103690

itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Itsourcecode
Products
Leave Management System
CVE-2026-103267

Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103068

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-81438

Risky Cryptographic Algorithm in Dell OpenManage Server Administrator Enables Remote Information Disclosure

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Dell Openmanage Server Administrator Managed Node (patch) For Windows Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 and 3 more
CVE-2026-65324

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-65100

Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58189

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58188

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58187

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Traffic Server Traffic Server
CVE-2026-58186

Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58185

Apache Traffic Server: Use-after-free in the intercept plugin

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58184

Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58183

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58182

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-81439

OpenManage Server Administrator Remote Authorization Bypass

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Dell Openmanage Server Administrator Managed Node For Rhel 8.10 Dell Openmanage Server Administrator Managed Node For Rhel 9.4 Dell Openmanage Server Administrator Managed Node For Sles 15 and 3 more
CVE-2026-58181

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58180

Apache Traffic Server: txn_box plugin overflows the stack from attacker input

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58179

Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2026-58178

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apache Traffic Server Traffic Server
CVE-2026-58175

Apache Traffic Server: HostDB SRV handling leaks memory

Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Traffic Server