Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,839

CVE-2026-47518

nvidia-driver: xorg-x11-drv-nvidia: nvidia-driver: Code execution via improper permission assignment in secure microcontroller

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Geforce Nvs Quadro and 2 more
CVE-2026-91072

EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-85520

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mypresta
Products
Google Merchant Center Feed
CVE-2026-94204

Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Viidure
Products
Dashcam Android Application
CVE-2026-49836

psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Psd-tools
Products
Psd-tools
CVE-2026-55062

uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Uniget-org
Products
Cli
CVE-2026-10739

Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Catonetworks
Products
Sdp Client
CVE-2026-10726

Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Catonetworks
Products
Sdp Client
CVE-2026-100638

SiYuan before v3.8.4 Path Traversal via setNotebookIcon

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook parameter to escape the workspace data directory and write conf.json files to arbitrary locations accessible by the kernel process.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-77268

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcp-atlassian Sooperset
Products
Mcp Atlassian Mcp-atlassian
CVE-2026-65125

Path Traversal Allowing External File Control in NVIDIA Infrastructure Controller

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Infra Controller Infrastructure Controller
CVE-2026-92164

Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Streamlink
Products
Streamlink
CVE-2026-19860

JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder — Dynamic Blocks Form Builder Jetformbuilder
CVE-2026-85887

M365 Copilot Information Disclosure Vulnerability

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-15952

Improper Permission Assignment in Scheduler Service

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Protection And Control Ied Manager (pcm600)
CVE-2026-39353

InvoicePlane: Remote Code Execution via Writable Templates Directory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as public_invoice_template. When a public invoice is rendered, the guest View controller includes the trusted file and executes it with web-server privileges. This issue is fixed in version 1.7.2-rc-1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Invoiceplane
Products
Invoiceplane
CVE-2026-77247

MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Mcp-atlassian Sooperset
Products
Mcp Atlassian Mcp-atlassian
CVE-2026-77256

MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Mcp-atlassian Sooperset
Products
Mcp Atlassian Mcp-atlassian