Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,932

CVE-2026-93635

Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution

LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zimbra
Products
Zimbra Collaboration Suite
CVE-2026-93637

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.

CVSS 3.1 · 3.7 Low EPSS 1.0% KEV · Not listed
Vendors
Zimbra
Products
Zimbra Collaboration Suite
CVE-2026-88794

XML External Entity injection in Sparx Enterprise Architect

Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Sparxsystems
Products
Enterprise Architect
CVE-2026-88964

Integer Underflow in OpenVPN Causing DoS and Memory Disclosure via Domain Search Options

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-88963

Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Tutor Lms Tutor Lms
CVE-2026-89097

Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 via the ai_wp_footer_hook. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive data including the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spacetime Wordpress-extensions
Products
Ad Inserter – Ad Manager & Adsense Ads Ad Inserter
CVE-2026-106470

WP Data Access < 5.5.88 - Subscriber+ SSRF

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Data Access
CVE-2026-86002

Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and processed by Bash eval during build, deploy, or run operations. Shell command substitutions in the stored values are interpreted on the host, allowing arbitrary command execution with the privileges of the dokku operating-system user. This issue is fixed in version 0.38.25.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Dokku
Products
Dokku
CVE-2026-85747

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Distribution
Products
Distribution
CVE-2026-84790

OpenVPN 2.7.x Remote Authenticated Certificate Subject Field for Account Impersonation

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-78433

Gitea private attachment disclosure through repository mismatch

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-78231

Gitea blind SSRF through OpenID assertion verification

When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-73814

Gitea repository ownership escalation by administrators

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea