Search vulnerabilities

Expected end of text, found '’' (at char 13), (line:1, col:14)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,864

CVE-2026-16741

OS Command in TR7 Cyber ​​Defense's TR7 ASP

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Tr7 Cyber ​​defense Inc.
Products
Tr7 Asp
CVE-2026-16740

Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP

Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239 before 1.6.1554.2331.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Tr7 Cyber ​​defense Inc.
Products
Tr7 Asp
CVE-2026-110259

OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded toByteArray() recursion and a StackOverflowError during transformation.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-110261

OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-110262

OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in forwardJumpStackFrames and allocation of hundreds of megabytes, leading to denial of service.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-110263

OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. Attackers can supply a crafted class file with a long Signature attribute containing many nested type arguments to trigger a StackOverflowError during class transformation, causing denial of service.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-110270

OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ow2
Products
Asm
CVE-2026-110594

BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Micropyramid
Products
Bottlecrm Django Crm
CVE-2026-110603

LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header

LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Rapidlasso
Products
Laszip
CVE-2026-110607

BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request /member/payment/test_post_pay_{paymentLogSn} to obtain goods without paying or settle other members' orders.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bizspring
Products
Bizspring Java Mall Bizspring Shop
CVE-2026-110608

BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bizspring
Products
Bizspring Java Mall Bizspring Shop
CVE-2026-110612

vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wwwlike
Products
Vlife
CVE-2026-110614

Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Yiuman
Products
Citrus
CVE-2026-110616

NullHub through 2026.5.29 Missing Authentication for /api Management API

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback listeners can control agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Nullclaw
Products
Nullhub
CVE-2026-110618

SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Pppscn
Products
Smsforwarder
CVE-2026-110629

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Venturedrake
Products
Laravel-crm
CVE-2026-110630

VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Venturedrake
Products
Laravel-crm
CVE-2026-110632

Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Report One
Products
Myreport Updater
CVE-2026-110634

git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.3% KEV · Not listed
Vendors
Danday74 Git-diff-apply Project
Products
Git-diff Git-diff-apply