Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,822

CVE-2026-126497

LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage

LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOffset values that cause decompress18 to write past the heap buffer when opened, causing crashes and potential code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Librecad
Products
Librecad
CVE-2026-126546

Viber for iOS through 29.4.0.24 Denial of Service via Malformed GIF

Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyException, aborting the app with SIGABRT when opened.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126545

WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-126544

WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-126543

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-126542

WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a victim's username and withhold email, causing login.json.php or oauth2.php to log them in as that account, including administrators, without a password.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-126541

WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-126499

Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints

Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Jellyfin
Products
Jellyfin
CVE-2026-126498

WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug

WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123084

Python-pulpcore: pulpcore: header content guard jq filter exposes the content-app environment

An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the content guard in the **Pulpcore** package. The guard is supposed to check a value in a request header. It saves a jq filter and runs that filter against the header when a client asks for content. The filter is not limited to the header, and jq's env builtin also returns the environment of the content process. A low-privileged network attacker or user who can create a header content guard and attach it to a distribution can save a filter that reads that environment. The content request is allowed or denied according to the filter result. Repeating the request lets that attacker or user recover the environment, including Pulp settings held there, such as the Django secret key or the database password.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Rhui Satellite
CVE-2026-126187

React: Unauthenticated Remote Code Execution in React Server Components

React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1.

CVSS 4.0 · 9.5 Critical EPSS 1.8% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123577

Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service

Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory exhaustion and denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123597

Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errors

Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient DS lookup errors as Bogus DNSSEC validation verdicts. An attacker who induces a SERVFAIL, REFUSED, or timeout response to a child-zone DS sub-query causes the validator to return SERVFAIL for all names under that zone until the cache entry's TTL expires.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123605

Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Name

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123573

hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parser

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123601

Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery

Hickory DNS hickory-proto 0.25.0 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 invert the relational operators in the wrap-around branch of find_covering_record() in nsec3.rs, so the last NSEC3 record in a zone's hash ring covers every hash except its owner. Attackers able to inject DNS responses can replay that NSEC3 record and its RRSIG to forge DNSSEC-validated negative responses denying legitimate names.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123581

Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRset

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can supply signed but unrelated RRsets so that responses lacking matching records are validated as positive answers instead of as no-data responses.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123593

Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchors

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto 0.24.0 through 0.26.0-alpha.1 compare DNSKEY public keys against DNSSEC trust anchors without checking the DNSKEY record name, so an RRset made up only of trusted keys is accepted without RRSIG verification. Attackers able to spoof or control name server responses can replace a secure zone's DNSKEY RRset with the root zone's keys, and use a large TTL to keep it cached.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123589

Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns
CVE-2026-123585

Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Records

The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the authority or additional sections, or outside the original query name's CNAME chain, causing excess resolver queries and increased query amplification.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hickory-dns
Products
Hickory-dns