Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-85324

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more
CVE-2026-84471

Use‑After‑Free in OpenVPN via Crafted TLS Packets

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-77829

Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Goratech Wordpress-extensions
Products
Cooked Cooked
CVE-2026-82153

Insecure Storage of Sensitive Information in Dell OS Recovery Tool Leading to Information Disclosure

Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Os Recovery Tool
CVE-2026-96658

Foreman: foreman: arbitrary code execution via safemode sandbox bypass

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Theforeman
Products
Enterprise Linux Satellite Satellite Capsule and 2 more
CVE-2026-78851

Directory Traversal in Grav CMS 2.0.3-2.0.6 via GravExtension.php enabling remote sensitive data disclosure

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Getgrav
Products
Grav Cms
CVE-2026-74920

Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Document Gallery
CVE-2026-74923

Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Document Gallery
CVE-2026-82844

WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpforms Lite
CVE-2026-77572

VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \.\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Veracrypt
Products
Veracrypt