Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,103

CVE-2026-15390

Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Denx Software Engineering
Products
Das U-boot
CVE-2026-85520

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mypresta
Products
Google Merchant Center Feed
CVE-2026-87748

Privilege Escalation via Account Takeover in Interprobe's Qorela DC

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Interprobe Information Technologies Inc.
Products
Qorela Dc
CVE-2026-102437

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Esengine
Products
Deepseek-reasonix
CVE-2026-82973

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Psyb0t
Products
Docker-mailbox
CVE-2026-102360

lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dmonad
Products
Lib0
CVE-2026-86450

Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Parla Auto
Products
Detawix Mobile Web Portal
CVE-2026-65102

Tensor Dimension Overflow Leading to Denial of Service in NVIDIA DeepStream

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Deepstream
CVE-2026-102371

wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Pro For Wsl
CVE-2026-102566

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Opennmt
Products
Ctranslate2
CVE-2026-102567

CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Opennmt
Products
Ctranslate2
CVE-2026-102568

Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including DNS filtering and application limits without authentication.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pardus
Products
Pardus-parental-control
CVE-2015-20122

Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp to retrieve sensitive information including credentials and system configuration data. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Yonyou
Products
A6 Oa
CVE-2026-63209

Integer Overflow or Wraparound and Out-of-bounds Write in compress

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Klauspost
Products
Compress
CVE-2023-54400

Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with potential for further compromise of the underlying server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Fumasoft
Products
Fumeng Cloud
CVE-2026-102600

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected. This issue is fixed in version 0.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Socket
Products
Cluster-engine Socket.io
CVE-2026-102810

Marmite through 0.4.2 Path Traversal via Development Server

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rochacbruno
Products
Marmite
CVE-2026-102811

Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rochacbruno
Products
Marmite
CVE-2026-102759

NetX Duo TLS MAC Verification Bypass via Empty Application-Data Record

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared. Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo