Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-18318

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-18343

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-81858

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-93886

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-96119

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2026-16275

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-74768

SSRF Vulnerability in Dell PowerProtect Data Manager REST API

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Manager
CVE-2026-73600

Stack Buffer Overflow in PowerProtect Data Manager's File‑Level Restore Agent Enables Information Disclosure

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Manager
CVE-2026-68860

Reliance on Data/Memory Layout Vulnerability in Dell PowerProtect Data Manager Allows Remote Phishing Attacks

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Manager
CVE-2026-85456

MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp
CVE-2026-85455

MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet

MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-85454

MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-85453

MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting

MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-85451

MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase

MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-85450

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion

MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates unbounded connections and threads without limits. Attackers can open many connections and send endless header data to exhaust server threads and memory, causing service unavailability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Themoos
Products
Core-moos
CVE-2026-85449

MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORT

MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp
CVE-2026-85448

MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention

MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory exhaustion and performance degradation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp
CVE-2026-85447

MOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of Service

MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-lived pipeways with many variables to cause pRealm to generate excessive output indefinitely, exhausting system resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp
CVE-2026-85446

MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic processing, delaying or preventing distribution of legitimate node reports.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp
CVE-2026-85445

MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Mit Moos-ivp
Products
Moos-ivp Moos-ivp