Search vulnerabilities

Expected end of text, found '’' (at char 13), (line:1, col:14)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2026-62200

OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-65525

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uxper Wordpress
Products
Civi Framework Wordpress
CVE-2026-17728

chromium-browser: chromium-browser: Inappropriate implementation in Extensions

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-17734

chromium-browser: chromium-browser: Inappropriate implementation in Autofill

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-17570

PAM Password History API Allows Credential Disclosure via Improper Access Control

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server Server
CVE-2026-16799

Unauthorized Reader Role Access to Automation Tests and Workflow Modification in Devolutions PowerShell Universal

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Powershell Universal
CVE-2026-17572

HDF5 SOHM List Index Heap Buffer Overflow

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hdfgroup
Products
Hdf5
CVE-2026-49743

GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-49744

GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Imaginationtech Linux
Products
Android Ddk Graphics Ddk and 1 more
CVE-2026-64704

Type Confusion Vulnerability Can Cause Unexpected System Termination

A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2026-111217

Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.

CVSS 4.0 · 8.6 High EPSS 7.0% KEV · Not listed
Vendors
Netgate Pfsense
Products
Pfsense Pfsense
CVE-2026-96243

Windows WalletService Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-96944

Windows Storage Information Disclosure Vulnerability

Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 8 more