Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-84838

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hardened Images Hummingbird and 1 more
CVE-2026-84233

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hardened Images Hummingbird and 1 more
CVE-2022-4329

Product list Widget for Woocommerce < 3.4.0 - Reflected XSS

The Product list Widget for Woocommerce WordPress plugin before 3.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Product List Widget For Woocommerce Project
Products
Product List Widget For Woocommerce
CVE-2026-119931

Windows Text Services Framework Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-116606

Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

CVSS 4.0 · 9.3 Critical EPSS 10.9% KEV · Listed
Vendors
Barracuda Barracuda Networks
Products
Email Security Gateway 300 Email Security Gateway 300 Firmware Email Security Gateway 400 and 8 more
CVE-2026-13764

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-16135

VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-2982

WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-15309

CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a new account that is automatically granted full administrator access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—