Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2026-95702

Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Gvisor
CVE-2026-93861

openstack-mistral: mistral: workflow membership sub-delegation allows unauthorized access grant to private workflows

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Mistral
CVE-2026-85975

Cleartext transmission in Progress MarkLogic Server Amazon S3 connections

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85966

Exposure of sensitive information in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85965

Use-after-free in Progress MarkLogic Server JavaScript engine integration

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85964

Path traversal in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85963

Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85962

Improper authentication in Progress MarkLogic Server SAML processing

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85961

Sensitive information exposure in Progress MarkLogic Server Azure deployments

On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85959

Insufficient authentication logging in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85958

Improper OAuth token validation in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-85953

Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-79838

HPE NonStop ODBC/MX Services - Memory corruption vulnerability

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-78357

Insufficient Session Revocation for JWT Authentication

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privileges of the affected agent or customer user even after the corresponding account has been deactivated or the user's password has been changed. The vulnerability does not allow an attacker to obtain authentication tokens by itself. Exploitation requires possession of a previously issued and still valid token. The actual impact depends on the privileges associated with the compromised token. Customer user tokens are limited to the permissions of the affected customer account, while agent tokens may provide access to broader ticket, customer, or administrative functionality depending on the assigned permissions. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs
CVE-2026-78356

Unauthenticated Disclosure of Agent Frontend Configuration

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. The exposed configuration does not directly contain user credentials or provide unauthorized modification of the OTRS configuration. However, the disclosed information may assist an attacker in fingerprinting the affected OTRS installation and identifying enabled functionality or security-relevant configuration that could be used to prepare further attacks. This issue affects OTRS: * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs
CVE-2026-78355

Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server process are relevant. Starting with OTRS 7, access is limited by the permissions of the dedicated OTRS user. Files with overly permissive ownership or file system permissions may therefore also be affected. The affected functionality may additionally attempt to include controlled files in a support bundle. However, support bundles are sent to a predefined OTRS support address, and direct disclosure of arbitrary files to the attacker has not been demonstrated. An attacker therefore requires valid administrative access to exploit the vulnerable functionality. The primary demonstrated impact is the deletion of files outside the intended directory within the effective permissions of the OTRS application process. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs Otrs Community Edition
CVE-2026-6232

Out-of-bounds write in LR11xx Transceiver

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Semtech
Products
Lr1110 Modem-e Lr1110 Transceiver Lr1120 Transceiver and 2 more
CVE-2026-66086

Stack-based Buffer Overflow in Modem

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Unisoc
Products
Modem
CVE-2026-48212

Stored XSS in external pages

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs
CVE-2026-48211

Cross-Site Request Forgery in Import/Export Admin console

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Otrs
Products
Otrs Otrs Community Edition