Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34,364

CVE-2026-76471

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Nx-os Software Unified Computing System Manager
CVE-2025-31200

Audio File Memory Corruption Enables Remote Code Execution on Apple Operating Systems

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1.

CVSS 3.1 · 9.8 Critical EPSS 20.9% KEV · Listed
Vendors
Apple
Products
Ipados Iphone Os Macos and 3 more
CVE-2026-73663

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freepbx Sangoma
Products
Missedcall Freepbx
CVE-2026-84272

IBM Guardium Data Protection Missing Authentication

IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-78401

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-16916

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-84249

IBM Guardium Data Protection is affected by vulnerability

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-62253

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sipcapture
Products
Homer
CVE-2026-17609

Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Webrehab Wordpress-extensions
Products
Super Forms – Drag & Drop Form Builder Super Forms
CVE-2026-107282

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related proxy context pointing at the original origin. Connection-pool selection, CONNECT handling, realm selection, and TLS setup can consequently send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination. Documented ResponseFilter failover and retry paths can trigger the replay. This issue is fixed in versions 3.0.13 and 2.16.1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Asynchttpclient Project
Products
Async-http-client
CVE-2026-106237

chromium-browser: Information leak in Permissions

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-106195

chromium-browser: Incorrect authorization in Chromoting

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-96327

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107845

Contao: Cross-site scripting in the comments bundle

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Contao
Products
Contao
CVE-2026-105697

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTO_LOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed
Vendors
Langflow
Products
Langflow Langflow-base Lfx
CVE-2026-73665

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Freepbx Sangoma
Products
Ucp Freepbx
CVE-2026-96331

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-94503

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—