Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,852

CVE-2026-39601

WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpdevelop
Products
Booking Calendar Booking Calendar
CVE-2026-96564

SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content (e.g., via bbPress forum topics) so that the injected display name is rendered in the tracking script.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Rainbowgeek Wordpress-extensions
Products
Seopress – Ai Seo Plugin & On-site Seo Seopress
CVE-2026-92085

Stored XSS in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tmt Machinery Industry And Trade Co. Ltd.
Products
Talassoft Industrial Management Software
CVE-2026-42696

WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration &amp; Cloning: from n/a through 1.5.19.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Royal Plugins Wordpress-extensions
Products
Sitevault – Backup, Restore, Migration &amp; Cloning Sitevault
CVE-2026-109201

LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Logicaldoc
Products
Logicaldoc Logicaldoc Community Edition
CVE-2026-13138

Improper Authorization in Divasoft Software's Biletiva Ticketing Platform

Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Divasoft Software And E-commerce Inc.
Products
Biletiva Ticketing Platform
CVE-2026-78556

TLS Server Certificate Validation Flaw in Industrial Edge App Publisher Enables MITM

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Industrial Edge App Publisher
CVE-2026-78557

Unsanitized Data in Industrial Edge App Publisher Enables Remote Code Execution

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Industrial Edge App Publisher
CVE-2026-85114

Unvalidated Ticket Response Allows Arbitrary File Write in Siemens .NET Client Library

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
.net Client Library For Simatic S7 Webserver Api
CVE-2026-65131

NVSentinel gRPC health‑event interface lacks authentication, enabling denial of service

NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Nvsentinel
CVE-2026-65197

H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.  This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
H3c
Products
Hdm Family-a G5
CVE-2026-65198

Huawei Default SNMPv3 USM key

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
Openubmc
CVE-2026-102342

ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting. This issue is fixed in versions 3.3.3, 4.0.3, and 4.1.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rust-ammonia
Products
Ammonia
CVE-2026-106108

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Quasarframework
Products
App-vite Quasar
CVE-2026-55675

Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Saltyorg
Products
Docs
CVE-2026-54640

OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and XMLInputFactory parsers that permit external entity resolution. This incomplete remediation of CVE-2026-40882 leaves the KNX handler unprotected while the parallel Velbus handler is hardened, allowing a regular realm user to read files accessible to the JVM process or cause server-side requests. This issue is fixed in version 1.24.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openremote
Products
Openremote Openremote-manager
CVE-2026-55183

RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Zarestia-dev
Products
Rclone-manager
CVE-2026-109412

Exposed Endpoint in Ivanti Neurons Patch for Intune Enables Leakage of Authentication Information

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ivanti
Products
Neurons Patch For Intune
CVE-2026-103030

Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cfug
Products
Dio