Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,864

CVE-2026-106575

ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-112936

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tox-dev
Products
Filelock
CVE-2026-83774

Windows Win32 Kernel Subsystem Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-112937

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion. This issue is fixed in version 4.2.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tox-dev
Products
Filelock
CVE-2025-62501

SSH Hostkey Misconfiguration Vulnerability in Archer Devices

SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Archer Ax53 Archer Ax53 Firmware
CVE-2026-112939

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Tox-dev
Products
Filelock
CVE-2026-107447

Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity

The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry restriction, trusting a client-supplied request header and an unbound client-generated token, which allows unauthenticated users to bypass the restriction and cast multiple votes for the same contest entry, inflating its vote total.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91265

JD Edwards EnterpriseOne Tools Unauthenticated Access Leading to Data Modification

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Jd Edwards Enterpriseone Tools
CVE-2026-105999

Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107127

Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107128

Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107237

Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107789

SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109926

Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111596

Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-50343

matio: From CVEorg collector

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Matio Project
Products
Matio
CVE-2026-93442

IBM QRadar SIEM Out-of-bounds Read

IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Qradar Security Information And Event Manager
CVE-2026-100145

Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105262

Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—