Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,871

CVE-2026-112299

smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Smrealms
Products
Smr
CVE-2026-112014

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI provider API key.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Netease-youdao
Products
Lobsterai
CVE-2026-112004

Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename folders in bases where they lack membership.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Teableio
Products
Teable
CVE-2026-111999

Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vanus-labs
Products
Vanus
CVE-2026-111723

LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lingguoai
Products
Lingguo-drama
CVE-2026-111713

tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Amauri
Products
Tarteaucitronjs
CVE-2026-109587

Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freertos
Products
Freertos-kernel
CVE-2026-97790

Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 8 more
CVE-2026-40246

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but does not return after sending the HTTP 404 response when validation fails. Execution continues and the subscription is deleted regardless. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by supplying any value for the influenceId path segment, while the API misleadingly returns a 404 Not Found response. A patched version was not available at the time of publication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Free5gc
Products
Free5gc Webconsole
CVE-2023-4659

Cross-Site Request Forgery in Free5Gc

Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an administrator, simply by changing the token value to "admin". It is also possible to perform POST, GET and DELETE requests without any token value. Therefore, an unprivileged remote user is able to create, delete and modify users within theapplication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Free5gc
Products
Webconsole
CVE-2026-44948

Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet
CVE-2026-41050

Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Rancher Rancher Fleet
CVE-2026-1961

Forman: foreman: remote code execution via command injection in websocket proxy

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.

CVSS 3.1 · 8 High EPSS 2.0% KEV · Not listed
Vendors
Red Hat Redhat Theforeman
Products
Red Hat Satellite 6 Enterprise Linux Satellite and 4 more