Search vulnerabilities

Expected end of text, found '/' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-112272

libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emersion
Products
Libdisplay-info
CVE-2026-112274

libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libtins
Products
Libtins
CVE-2026-112280

libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nkoriyama
Products
Aribb24
CVE-2026-112281

libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi

libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nkoriyama
Products
Aribb24
CVE-2026-112284

libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Xqq
Products
Libaribcaption
CVE-2026-112289

Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Koalixswitzerland
Products
Koalixcrm
CVE-2026-112290

MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mi6
Products
Intelligence Community Ui Kit Canary Web Components
CVE-2026-112291

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Flarum
Products
Extension Manager
CVE-2026-112292

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Operacle
Products
Checkcle
CVE-2026-86375

Missing Encryption of Sensitive Data in Dell Application Installer

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Application Installer
CVE-2026-112303

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gdevelop
Products
Gdevelop
CVE-2026-112308

crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Crewai Crewaiinc
Products
Crewai Crewai-tools
CVE-2026-12254

Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue

Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Netskope
Products
Netskope Client
CVE-2026-111045

CLI Bridge: High-severity sandbox escape via dangling symlink

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Anshupriyan
Products
Cli-bridge
CVE-2026-111058

Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mljar
Products
Mercury
CVE-2026-111059

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mljar
Products
Mercury
CVE-2026-112377

CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ccc-attestation
Products
Attested-tls-poc
CVE-2026-100134

Acrobat for Edge | Out-of-bounds Write (CWE-787)

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Acrobat For Edge
CVE-2024-10306

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Core Services Rhel Eus