Search vulnerabilities

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,894

CVE-2026-84900

HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates

Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.1 SP10, which includes updates to mitigate potential vulnerabilities.  Previous versions of HP ThinPro (prior to HP ThinPro 9 SP3) could potentially contain security vulnerabilities. HP has released HP ThinPro 9 SP3, which includes updates to mitigate potential vulnerabilities.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hp Inc.
Products
Hp Thinpro 8.1 Hp Thinpro 9
CVE-2026-0482

Insufficient USB boot boundary check enabling buffer overflow and arbitrary code execution

In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Alveo Accelerator Cards Versal Ai Core Series Adaptive Socs Versal Ai Edge Series Adaptive Socs and 5 more
CVE-2026-103546

Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator

In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Controllers For Kubernetes
CVE-2026-103433

Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Docker
Products
Buildx
CVE-2026-82988

CVE-2026-82988

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Viewsonic
Products
Vcast
CVE-2026-104380

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Perl
Products
Punk
CVE-2026-105486

OSSRS srs System API api.go systemAPI.Run missing authentication

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ossrs
Products
Srs
CVE-2026-105707

uptrace user_handler.go Login information exposure

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Uptrace
Products
Uptrace
CVE-2026-42634

WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bplugins Wordpress-extensions
Products
Video Background Block – Use Video As Background In The Section. Video Background Block Use Video As Background In The Section
CVE-2026-48197

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress-extensions
Products
Capabilities Publishpress Capabilities