Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,103

CVE-2026-111608

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Jeequan
Products
Jeepay
CVE-2026-111603

PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download endpoints to obtain course structure and attachment files from other departments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Playeduos
Products
Playedu
CVE-2026-98727

nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespace is registered without zoned limits while the head still advertises the zoned capability with a zone size of zero, and reporting zones or writing to the head then shifts by ilog2(0). Drop the zoned feature from the head allocation and let the head limits refresh stack it in from the path namespace instead.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98728

tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2_get_random() When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random() skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end, so stale buffer contents end up in the caller's random bytes. Fix this by checking the response length against 'offset', which already includes the skipped parameter size field.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-95710

Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8

An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected system, with a limited impact to the integrity of the affected component.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-79894

Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos
CVE-2026-17271

IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-18250

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-17222

IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-13739

Server-Side Request Forgery (SSRF)

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Commvault
Products
Commvault
CVE-2026-98759

usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() cd321x_update_work() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero-initialize the descriptor so optional callbacks remain NULL and the remaining fields are zero.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-91638

Oracle Essbase Remote Code Execution Vulnerability

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Essbase
CVE-2026-98090

btrfs: restore active device pointers after failed sprout

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfs_init_new_device() switches latest_dev and possibly s_bdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the subsequent sprout setup fails, the error path releases the new device without switching those pointers back. btrfs_show_devname() can then dereference the freed latest_dev and crash. Restore the active device pointers to the latest seed device before removing and releasing the failed sprout device.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-98091

btrfs: detach failed sprout device from transaction update list

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, create_chunk() adds the new device to the transaction dev_update_list through device->post_commit_list. If the subsequent system chunk creation fails, btrfs_init_new_device() aborts the transaction and releases the device while post_commit_list is still linked. This triggers a warning in btrfs_free_device() and leaves the transaction list referencing freed memory. Detach the device while holding chunk_mutex before releasing it.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel