Search vulnerabilities

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,860

CVE-2026-106407

chromium-browser: Incorrect authorization in GetUserMedia

Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-106408

chromium-browser: Protection mechanism failure in Mobile

Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Iphone Os Chrome
CVE-2026-78406

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-102490

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owned and writable by the zammad account before dropping their identity to that account. An attacker holding that foothold could have escalated within seconds, because the affected services were restarted automatically whenever they stopped; no administrator interaction was required. Only installations from the DEB and RPM packages were affected — installations from source or the official container images were not. All released packaged versions were affected.

CVSS 4.0 · 9.4 Critical EPSS 10.9% KEV · Listed
Vendors
Docker Linux Zammad
Products
Docker Linux Kernel Zammad
CVE-2026-84209

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Guardium Data Protection
CVE-2026-18740

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-11318

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Zuler Technology
Products
Deskin
CVE-2026-107831

Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Banq
Products
Jivejdon
CVE-2026-107715

Mechanize sends credential headers to another host after an HTTP redirect

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sparklemotion
Products
Mechanize
CVE-2026-105827

ImageMagick: ImageMagick: Denial of Service via uncontrolled recursion in CALS decoder

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105826

ImageMagick: ImageMagick: Denial of Service via MAT decoder policy bypass

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105825

ImageMagick: ImageMagick: Denial of Service via crafted XMP profile

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105824

ImageMagick: ImageMagick: Denial of Service via crafted SVG file in RSVG decoder

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105823

ImageMagick: ImageMagick: Security policy bypass via CUT encoder

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 4.0 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105405

ImageMagick: ImageMagick: Denial of Service via crafted MVG image

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105404

ImageMagick: ImageMagick: Code injection via PostScript coders

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105403

ImageMagick: ImageMagick: Security policy bypass via crafted image

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 6.2 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105402

ImageMagick: ImageMagick: Denial of Service via crafted XMP profile

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick
CVE-2026-105401

ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in distributed pixel cache server

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Imagemagick
Products
Imagemagick