Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,822

CVE-2026-85805

Microsoft PowerShell Security Feature Bypass Vulnerability

Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-85333

Windows Performance Monitor Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-111397

WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pt Norther Lights Production Wordpress-extensions
Products
Mapsvg Mapsvg
CVE-2026-113788

Lagoon core ssh service vulnerable to remote code execution

Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh` service in Lagoon core can be disabled. The `ssh-portal` service and components are not effected and can continue to be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Uselagoon
Products
Lagoon
CVE-2026-111663

Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Chaskiq
Products
Chaskiq
CVE-2026-111658

SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API

SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Siteserver Sscms
Products
Sscms Sscms
CVE-2016-20104

EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eyelock
Products
Nano Nxt
CVE-2015-20128

FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Foosun
Products
Dotnetcms
CVE-2014-125133

NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109433

Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled(). Attackers with minimal Cockpit access can exploit a non-empty disabledPermissions configuration to read all process instances, process definitions, and incidents engine-wide without triggering any logging, regardless of their actual data grants.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Camunda
Products
Camunda 7
CVE-2012-20003

Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php with s=1 and a malicious key value to execute script in victims' browsers and steal cookies. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-112857

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-112853

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115723

Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and send a short fragment, causing BRecv to memcpy past the buffer and crash or corrupt SCADA, HMI or gateway processes.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Snap7 Project
Products
Snap7