Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-96428

Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96429

Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96430

Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96431

Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-96440

Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flowring Technology Corp
Products
Agentflow 4.0
CVE-2026-76718

HPE OneView - Cross-site scripting vulnerability

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise
Products
Hpe Oneview
CVE-2026-76719

HPE OneView - Cross-site scripting vulnerability

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise
Products
Hpe Oneview
CVE-2026-15390

Out-of-bounds write in Das U-Boot

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Denx Software Engineering
Products
Das U-boot
CVE-2026-85520

Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE). This issue was fixed in version 2.3.9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Mypresta
Products
Google Merchant Center Feed
CVE-2026-87748

Privilege Escalation via Account Takeover in Interprobe's Qorela DC

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Interprobe Information Technologies Inc.
Products
Qorela Dc
CVE-2026-102437

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Esengine
Products
Deepseek-reasonix
CVE-2026-82973

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Psyb0t
Products
Docker-mailbox
CVE-2026-102360

lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dmonad
Products
Lib0
CVE-2026-86450

Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Parla Auto
Products
Detawix Mobile Web Portal
CVE-2026-65102

Tensor Dimension Overflow Leading to Denial of Service in NVIDIA DeepStream

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Deepstream
CVE-2026-102371

wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument (pro attach <token>). On systems where /proc is mounted without process-hiding mitigations (such as hidepid), which is the default in WSL, an unprivileged local user or process in the same WSL instance can read the token from /proc/<pid>/cmdline while the attach process is running. The leaked token could then be used to attach other machines to the victim's Ubuntu Pro subscription and gain unauthorized access to Ubuntu Pro services.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Ubuntu Pro For Wsl
CVE-2026-102566

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Opennmt
Products
Ctranslate2
CVE-2026-102567

CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Opennmt
Products
Ctranslate2