Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2026-109628

Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109623

Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization

Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109615

Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109610

Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109602

Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-109572

Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy

Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Openwebui
Products
Open Webui
CVE-2026-109569

sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Th0rgal
Products
Sandboxed.sh
CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Tianma-if
Products
Edgeever
CVE-2026-109397

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-109379

Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an incomplete timing fix in /auth/check. Attackers can post login attempts and measure response times, since existing accounts incur two bcrypt operations versus one, revealing valid usernames and email addresses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cockpit-hq
Products
Cockpit
CVE-2026-109373

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them with empty tokens to receive rotated tokens, taking over accounts including MFA-completed administrator sessions.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Zitadel
Products
Zitadel
CVE-2026-109372

ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Zitadel
Products
Zitadel
CVE-2026-109364

Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-109363

Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zcashfoundation Zfnd
Products
Zebra Zebra
CVE-2026-109359

Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain trusted mesh certificates, or with the secret seed disclose the Mesh CA key.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Edgelesssys
Products
Contrast
CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Edgelesssys
Products
Contrast
CVE-2026-109354

LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traversed channel value to view traffic and NetFlow graphs of devices outside their authorized scope.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Librenms
Products
Librenms
CVE-2026-109353

LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Librenms
Products
Librenms
CVE-2026-109349

gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date
CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date