Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-108974

SourceCodester E-Learning System Users.php save_users unrestricted upload

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
E-learning System
CVE-2026-108970

itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Itsmeravitejak
Products
Online-examination-system
CVE-2026-108966

SourceCodester Performance Indicator System product.php sql injection

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Performance Indicator System
CVE-2026-109688

WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105882

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-88755

Zai ZCode RCE via Automatic MCP Server Connection

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-101337

Stack overwrite from specially formatted base64 RDATA field

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Nsd
CVE-2026-101338

Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Nsd
CVE-2026-101339

Stack overwrite from a specially crafted and formatted HIP RR

A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Nsd
CVE-2026-101341

Stack overwrite from specially formatted TXT-DATA RDATA field

Tokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which are written out by NSD itself, such for zones for which the NSD instance is secondary, will not be formatted like this. The zone file must be fed to NSD directly, (but it could come, for example, from an operator controlled provisioning system).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nlnetlabs
Products
Nsd
CVE-2026-101895

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering processes attacker-controlled HTML containing an incomplete DOCTYPE that ends with whitespace at end of input. In Domino lib/HTMLParser.js, after_doctype_name_state emits doctype and EOF tokens without advancing nextchar or leaving the fixed-lookahead state, so the scanner repeatedly handles the same EOF marker. A remote unauthenticated attacker can use this condition through server-side HTML parsing paths such as innerHTML binding to consume a Node.js SSR worker at full CPU, starve the event loop, and stop concurrent and subsequent requests. This issue is fixed in versions 20.3.31, 21.2.23, and 22.1.6.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Angular
Products
Angular Platform-server
CVE-2026-101927

Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation

A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved on all platforms allows an unprivileged local attacker to cause a denial of service (DoS) or achieve privilege escalation to root via crafted IPC event messages.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101934

Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd

An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved allows a local attacker to cause a Denial of Service (DoS) via sending a crafted packet to the eventd relay service.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper Networks
Products
Junos Os Junos Os Evolved
CVE-2026-101309

Multiple vulnerabilities in bhyve device models

The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification by the guest. This race condition could be triggered by a guest running malicious, privileged code. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2026-101310

Multiple vulnerabilities in bhyve device models

The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modification by the guest after validation. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2026-101311

Multiple vulnerabilities in bhyve device models

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering threads were not synchronized. A malicious guest can crash the bhyve process or potentially execute arbitrary code in the host userspace context running the virtual machine, subject to bhyve's Capsicum sandbox.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Freebsd
Products
Freebsd
CVE-2026-100193

Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Tutor Lms Tutor Lms