Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2026-112247

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This affects an unknown function of the file /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx of the component Upload Endpoint. Executing a manipulation of the argument NewFile can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wuxi Wubang Security Software
Products
Five-in-one Safety Production Management Information System
CVE-2026-112159

JumpServer Template Rendering os command injection

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.

CVSS 4.0 · 5.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Jumpserver
Products
Jumpserver
CVE-2026-111757

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hono
Products
Hono
CVE-2026-111066

AIOHTTP: File descriptor exhaustion in multipart requests

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp
CVE-2026-105453

IBM Sterling Connect:Direct for Unix Improper Privilege Management

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sterling Connect Direct
CVE-2026-101304

Multiple jail filesystem root escapes

When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2025-36069

TS4500 Tape Library Insufficient Session Expiration

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Ts4500 Library
CVE-2026-113353

LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress-extensions
Products
Learnpress Learnpress
CVE-2026-110249

Denial-of-service in the Exchange email component

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Thunderbird
CVE-2026-98154

nvme-rdma: fix -EIO cleanup order in queue_rq

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-101292

Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Amq Broker 7 Jboss Enterprise Application Platform and 1 more
CVE-2026-97278

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wp Syntex
Products
Polylang Polylang
CVE-2026-113465

Possible DOM XSS in SNS Web Administration Portal

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Stormshield
Products
Stormshield Network Security
CVE-2026-101201

QBinaryJson::fromBinaryData() integer overflow leading to OOB read

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt Qt5compat Qtbase
CVE-2026-110976

AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ai Engine
CVE-2026-44938

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This allows the attacker to weaken admission controls and deploy workloads that PSS policies would otherwise block.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet