Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,898

CVE-2026-107870

WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetengine Jetengine
CVE-2026-102087

Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specific valid BGP-LS attribute is received rpd crashes

An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). When in a BGP traffic engineering scenario a specific, valid, optional, non-transitive BGP update is received over an established BGP session, RPD crashes and automatically restarts, which leads to traffic impact until routing has reconverged. This issue affects: Junos OS: * All versions before 23.2R2-S6; * 23.4 versions before 23.4R2-S7; * 24.2 versions before 24.2R2-S4; * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R1-S2, 25.2R2; Junos OS Evolved: * All versions before 23.2R2-S6-EVO; * 23.4 versions before 23.4R2-S8.11-EVO; * 24.2 versions before 24.2R2-S4-EVO; * 24.4 versions before 24.4R2-S5-EVO; * 25.2 versions before 25.2R1-S2-EVO, 25.2R2-EVO;

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-92120

Apache Allura: Oauth1 Replay Attack

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Allura
CVE-2026-109757

Sandbox escape due to race condition in the Networking component

Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2026-108388

Indico legacy contribution export cache poisoning discloses restricted metadata

Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribution-management permission. A low-privileged user can induce a privileged user to request a crafted legacy contribution export and cause speaker or author email addresses and contribution access-control entries to be stored in an API cache entry retrievable with less privilege. This issue was fixed in Indico 3.3.14.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Indico
Products
Indico
CVE-2026-108390

HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Hestiacp
Products
Hestiacp
CVE-2026-103895

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Cyberlord92 Wordpress-extensions
Products
Miniorange Otp Login, Verification And Sms Notifications Miniorange Otp Login, Verification And Sms Notifications
CVE-2024-34319

SSRF via Unvalidated serviceURL Parameter in ProPhoenix Law RMS

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-34320

Incorrect Access Control in ProPhoenix Law RMS API Endpoints

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-34324

Session Hijacking via Crafted ASP.NET_SessionId Cookie in ProPhoenix Law RMS

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-95124

Buffer Overflow in libconfini Leading to Remote Denial of Service

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch between its bundled load_ini_buffer utility and strip_ini_cache()

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Madmurphy
Products
Libconfini
CVE-2026-78799

Directory Traversal in iKuai Wi-Fi 6 Routers Enables Remote Code Execution

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
—
Products
—
CVE-2026-77093

CvFWD Denial of Service

CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-10813

LMCache KV Cache utils.py hex_hash_to_int16 weak hash

A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vllm/utils.py of the component KV Cache Handler. Executing a manipulation can lead to use of weak hash. The attack needs to be launched locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. Upgrading to version 0.5.5 is able to mitigate this issue. This patch is called ce08eea76ce5898200efee55f4932fd07a7cabeb. It is suggested to upgrade the affected component. A contributor of the project confirms: "hex_hash_to_int16() was introduced in 0.3.1 (PR #882, commit f5174701). It is not present in 0.3.0, and it is still present in 0.4.7 through 0.5.4."

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Lmcache
Products
Lmcache
CVE-2026-104585

Command Injection Vulnerability in Mobile Security Framework (MobSF) v4.5.2

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103417

Saved credentials can be autofilled after cross-origin navigation

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox For Ios
CVE-2026-109725

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox