Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-93640

Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Zimbra
Products
Zimbra Collaboration Suite
CVE-2026-46346

Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Intranda
Products
Goobi Viewer Core
CVE-2026-55459

Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Intranda
Products
Goobi Viewer Core
CVE-2026-115754

serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Yahoo
Products
Serialize-javascript Serialize Javascript
CVE-2026-53920

odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openwrt
Products
Odhcpd
CVE-2026-9869

Stack-Based Buffer Overflow in TR069 Interface of Totolink X2000R Enables Remote Code Execution

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-9827

Arbitrary File Write Enabling Remote Code Execution via formUploadFile on Totolink X2000R

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-9817

Stack‑Based Buffer Overflow in TOTOLINK X2000R Boa formUploadFile Enables Arbitrary Code Execution by Authenticated Users

A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-9814

OS Command Injection in X2000R boa formWizard newPass

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-9660

Stack-Based Buffer Overflow in Totolink X2000R Boa formFilter Allows Remote Code Execution

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42026

Stack-based Buffer Overflow in Totolink X2000R DHCP DNS Functionality

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42024

Stack‑Based Buffer Overflow in Totolink X2000R IPv6 Static Configuration Leading to Arbitrary Code Execution

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42023

Stack-based buffer overflow in Totolink X2000R static IPv6 configuration allows remote code execution

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42022

Stack‑Based Buffer Overflow in Totolink X2000R Static IPv6 Configuration

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-42021

Stack-Based Buffer Overflow in Totolink X2000R HTTP Interface Leading to Arbitrary Code Execution

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-35499

OS Command Injection in Totolink X2000R Boa FormWsc PeerRptPin Leading to Remote Code Execution

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CVSS 3.1 · 9.1 Critical EPSS 1.3% KEV · Not listed
Vendors
Totolink
Products
X2000r
CVE-2026-114263

ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection

A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the function mysqli_query of the file individual_report_search.php. Such manipulation of the argument roll_number leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Projectworlds
Products
Advanced Library Management System
CVE-2026-114260

oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
File-management-system-php
CVE-2026-114257

oretnom23 file-management-system-php File Download download.php readfile sql injection

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
File-management-system-php