Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 34,364

CVE-2025-70518

Unauthenticated Command Injection in Fanvil x7a Diagnostic Ping Tool

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Fanvil
Products
X7a
CVE-2025-70521

Unauthenticated Remote Command Execution via Web Management Portal in Fanvil x7a Firmware 2.6.0.1182

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fanvil
Products
X7a
CVE-2026-59346

VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Vmware
Products
Vmware Fusion Vmware Workstation
CVE-2026-102782

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization:

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ordasoft.com
Products
Ordasoft Simple Membership Extension For Joomla
CVE-2026-96408

Unauthenticated Code Injection via Upgrade Script in Movable Type

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Six Apart
Products
Movable Type Movable Type Cloud Edition Movable Type Premium and 1 more
CVE-2026-107202

CVE-2026-107202

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Jonssonyan
Products
H-ui
CVE-2026-20328

Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to reset the password of an arbitrary account, including high-privileged administrative user accounts, possibly allowing the attacker to gain unauthorized access to the application as any user.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Cisco License On-prem
CVE-2026-76454

Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Cisco License On-prem
CVE-2026-62252

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sipcapture
Products
Homer
CVE-2026-95605

WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Passionate Programmer Peter Wordpress-extensions
Products
Wp Data Access Wp Data Access
CVE-2026-107459

Openfind｜SecuShare Pro - OS Command Injection

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed
Vendors
Openfind
Products
Secushare Pro
CVE-2026-103646

Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Ultimate Multisite
CVE-2026-103692

Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call

The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Frontend Dashboard
CVE-2026-85097

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Bricksforge Wordpress-extensions
Products
Bricksforge Bricksforge
CVE-2026-12260

SQL injection in the NetBoard CRM demo platform

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Netboard Crm
Products
Netboard Crm Demo Platform
CVE-2026-105110

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.

CVSS 4.0 · 9.3 Critical EPSS 3.0% KEV · Not listed
Vendors
Iskratel
Products
Innbox
CVE-2026-92555

Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Akin
Products
Akinsoft Wolvox Control Panel
CVE-2026-19218

Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Akin
Products
Myrezzta
CVE-2026-107640

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Integrics
Products
Enswitch