Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-126802

NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126801

Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126800

Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class

Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126798

NextScan 1.1.0 through 1.2.0 Stored XSS via URL Asset Detail View

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126797

NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin

NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125926

Server-side request forgery in the server registration and update API in mcp-gateway-registry

Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request. To remediate this issue, users should upgrade to version 1.35.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Mcp-gateway-registry
CVE-2026-118288

Microsoft Azure File Sync Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure File Sync Azure File Sync V22
CVE-2026-116926

Microsoft Teams Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-116930

Microsoft SQL Server Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Microsoft Sql Server 2017 For X64-based Systems \(cu31\) Microsoft Sql Server 2019 For X64-based Systems \(cu32\) Microsoft Sql Server 2022 For X64-based Systems \(cu27\) and 5 more
CVE-2026-105562

Windows Container Manager Service Information Disclosure Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Container Manager Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 11 more
CVE-2026-65957

Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-100307

Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator

Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request. To remediate this issue, users should upgrade to version 1.25.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Mcp-gateway-registry