Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-89208

Unfiltered Input Bounds Validation Allows Remote Out-of-Bounds Memory Read in Siemens Embedded Systems

A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Capital Embedded Ar Classic 431-422 Capital Embedded Ar Classic R20-11 Desigo Pxc00-e.d and 12 more
CVE-2026-89279

Active Directory Password Change CSRF in AuthTake Technology's authtake

Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Authtake Technology
Products
Authtake
CVE-2026-94410

Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bender
Products
Customer&partner Customer Platform Software
CVE-2026-53562

Local Privilege Escalation

Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Citrix
Products
Uniconos
CVE-2026-107605

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Swann Communications
Products
Swifi-se2kic
CVE-2026-107606

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Swann Communications
Products
Swifi-se2kic
CVE-2026-107607

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Swann Communications
Products
Swifi-se2kic
CVE-2026-54086

SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service

SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and allocates a byte array without an upper bound, while malformed or truncated input can also terminate reads unexpectedly, allowing an unauthenticated client of the SLE listening service to trigger exceptions, resource leakage, and denial of service. This issue is fixed in version 5.1.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Esa
Products
Sleapi-j
CVE-2026-103967

Adobe Framemaker | Out-of-bounds Write (CWE-787)

Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Framemaker 2022 Adobe Framemaker 2026
CVE-2026-103966

Adobe Framemaker | Heap-based Buffer Overflow (CWE-122)

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Framemaker 2022 Adobe Framemaker 2026
CVE-2026-110209

ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video
CVE-2026-110210

Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Phase
Products
Phase Console
CVE-2026-94453

IKEv2 Use-After-Free bug when using IKE-over-TCP

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Libreswan
Products
Libreswan
CVE-2026-77205

Denial of Service via sending bogus X.509 certificates

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Libreswan
Products
Libreswan
CVE-2026-77206

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Libreswan
Products
Libreswan