Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,871

CVE-2026-28331

SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Solarwinds
Products
Patch Manager
CVE-2026-98155

accel/qaic: Address potential out-of-bounds read in resp_worker()

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-77936

Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Letta
Products
Letta
CVE-2026-63619

Apache Kylin: Missing authorization and path-confinement on system meta dump

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-43851

Authenticated Path Traversal Vulnerability Enabling Arbitrary File Read on Advantech ADAM-3600

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43849

Heap Memory Read Allows Sensitive Data Exfiltration in Advantech ADAM-3600

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43847

Brute-Force Administrator Password Vulnerability in Advantech ADAM‑3600 Proprietary Protocol

A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-43846

Stack‑Based Buffer Overflow Vulnerability in Advantech ADAM‑3600

A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-113703

SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Giuseppe99barchetta
Products
Suggestarr
CVE-2026-113676

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists, resource limits, notes, and login history.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Froxlor
Products
Froxlor
CVE-2026-113612

SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Codewithcj
Products
Sparkyfitness
CVE-2026-113609

Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Bandisoft
Products
Bandizip
CVE-2026-113599

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Modoboa
Products
Modoboa
CVE-2026-113597

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blinko Blinkospace
Products
Blinko Blinko
CVE-2026-113396

DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Draytek
Products
Vigor2960 Vigor2960 Firmware
CVE-2026-113388

opensource-socialnetwork Cache Settings dynamic.php input code injection

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opensource-socialnetwork
Products
Opensource-socialnetwork