Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-110929

openssh: openssh: post-authentication process retains root without file-descriptor passing

A flaw was found in OpenSSH. On platforms that cannot pass file descriptors and that need root to allocate a terminal, the post-authentication session process keeps root privilege. An authenticated user can then perform actions as root, including privileged socket connections and binding forwards to low-numbered ports.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
Openssh
Products
Openssh
CVE-2026-110809

sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sgl-project
Products
Sglang
CVE-2026-111157

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sox
Products
Sox
CVE-2026-110859

GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Gitpython-developers Gitpython Project
Products
Gitpython Gitpython
CVE-2026-110670

cemtan sar2html Archive Processing sar2html.py updateDb sql injection

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cemtan
Products
Sar2html
CVE-2026-110928

openssh: openssh: authorized_keys restrict does not apply to tunnel forwarding

A flaw was found in OpenSSH. The authorized_keys "restrict" keyword was not applied to tunnel forwarding. When PermitTunnel is enabled, a restricted key can still open a tunnel.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
Openssh
Products
Openssh
CVE-2026-88096

Windows DCOM Server Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 25 more
CVE-2026-110456

Improper Access Control in UniFi Protect AI Key Allows Unauthorized Network Resource Access

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ubiquiti
Products
Unifi Protect Ai Key
CVE-2026-110458

Local Path Traversal in UniFi Protect AI Key Enables File Manipulation

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ubiquiti
Products
Unifi Protect Ai Key
CVE-2026-110854

Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Parse Community Parseplatform
Products
Parse Server Parse-server
CVE-2026-110857

GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Gitpython-developers Gitpython Project
Products
Gitpython Gitpython
CVE-2026-110858

GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Gitpython-developers Gitpython Project
Products
Gitpython Gitpython
CVE-2026-35073

OS Command Injection in Dell PowerProtect Data Domain Firmware

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Data Domain Operating System Powerprotect Data Domain
CVE-2026-110764

AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Astron-rpa
CVE-2026-110642

xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

CVSS 4.0 · 8.5 High EPSS 1.1% KEV · Not listed
Vendors
Xhtml2pdf
Products
Xhtml2pdf