Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2026-87369

Unauthenticated HTTP Denial of Service in Oracle Service Bus

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Service Bus
CVE-2026-84920

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Unpublished Node Permissions
CVE-2026-82814

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPX_UpdateEngine::unserializeTest() during migration. This allows unauthenticated attackers to store a serialized object in public site content before an administrator builds a package and later performs a migration or import that runs database search-and-replace. Duplicator Free bundles a Requests 1.7 POP chain that permits attacker-selected callbacks, resulting in direct operating-system command execution. Duplicator Pro bundles an IndexList destructor gadget that permits deletion of an attacker-selected existing file when its containing directory is writable by the installer PHP process; deletion of wp-config.php can expose the setup wizard and lead to site takeover and code execution if the attacker reaches it first and supplies a reachable database they control. The package must be created after the carrier is stored, and a later administrator migration action is required.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-55200

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

CVSS 4.0 · 9.2 Critical EPSS 3.9% KEV · Not listed
Vendors
Libssh2
Products
Libssh2
CVE-2026-15634

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-15412

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8  could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-15396

IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-13599

ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB

Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Ability Edgenius
CVE-2026-115496

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-115494

CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub

A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114570

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2026-114220

NewType Infortech｜NT OneAPP - Improper Certificate Validation

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Newtype Infortech
Products
Nt Oneapp
CVE-2026-114219

NewType Infortech｜NT OneAPP - Hard-coded Credentials

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Newtype Infortech
Products
Nt Oneapp
CVE-2026-114052

vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to the /tokenize endpoint, which bypasses --api-key, to exhaust host memory and crash the API process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-114047

FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-114042

FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the client during teardown.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-113872

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Multer
Products
Multer