Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,103

CVE-2026-115496

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115494

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114570

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2026-114220

NewType Infortech｜NT OneAPP - Improper Certificate Validation

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Newtype Infortech
Products
Nt Oneapp
CVE-2026-114219

NewType Infortech｜NT OneAPP - Hard-coded Credentials

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Newtype Infortech
Products
Nt Oneapp
CVE-2026-114052

vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-114047

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-114042

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-113872

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Multer
Products
Multer
CVE-2026-111181

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Body-parser
Products
Body-parser
CVE-2026-110354

haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Haproxy
Products
Haproxy Haproxy Enterprise Kubernetes Ingress Controller and 1 more
CVE-2026-110353

haproxy: HAProxy: Denial of Service via truncated HTTP/2 PING frame

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Haproxy
Products
Haproxy Haproxy Enterprise Kubernetes Ingress Controller and 1 more
CVE-2026-101695

Low‑Privilege HTTP Attack Enables Unauthorized Data Manipulation and Denial of Service in Oracle One‑to‑One Fulfillment

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
One-to-one Fulfillment
CVE-2026-101587

Partial Denial of Service via Unauthenticated HTTP Access in Helidon

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Helidon
CVE-2026-101569

Helidon Unauthenticated HTTP Vulnerability Leading to Data Modification and Partial Denial of Service

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Helidon
CVE-2026-101399

Unauthenticated SMTP-Based Partial Denial of Service in Oracle Siebel Marketing

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Siebel Apps - Marketing
CVE-2026-101359

Unauthenticated HTTP Data Modification in Oracle REST Data Services

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Rest Data Services
CVE-2026-71010

Local privilege escalation in Oracle Commerce Guided Search enabling takeover with user interaction

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Commerce Guided Search / Oracle Commerce Experience Manager executes to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Commerce Experience Manager Commerce Guided Search Commerce Guided Search \/ Oracle Commerce Experience Manager
CVE-2026-83661

Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Photoshop Macos Windows