Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-100522

Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cotonti
Products
Cotonti Cotonti Siena
CVE-2026-100504

Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128

Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts from p-code. Attackers can craft malicious binaries with specific instruction sequences that trigger the overflow when decompiled, corrupting memory and potentially achieving code execution.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Nationalsecurityagency Nsa
Products
Ghidra Ghidra
CVE-2025-71423

Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure

Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets are exposed to any Kubernetes user with get or list permission on pods/logs. Because workload secrets are used for encrypted storage and Vault integration, those must also be considered compromised. This is a regression of GHSA-h5f8-crrq-4pw8.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Edgelesssys
Products
Contrast
CVE-2026-88828

Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Blacklist Manager For Woocommerce
CVE-2026-89411

Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Paymattic
CVE-2026-97335

Incorrect authorization in LXD storage volume API allows reading volumes from other projects

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-87799

Arbitrary file write on LXD host via symlink in migration stream

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-87798

LXD client recursive file pull allows directory escape via malicious VM agent

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-86335

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-85185

Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-82928

Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
F F Filipowski
Products
Mh-developer
CVE-2026-81882

radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The vulnerability is triggered by running the explicit pFB or pFBj commands on untrusted binary property-list data. The json encoder treated the converted data as a nul-terminated c string and could continue reading beyond the allocation. This can cause disclosure of uninitialized or adjacent heap contents in JSON output and possible process termination. This issue is fixed in version 6.2.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Radare Radareorg
Products
Radare2 Radare2
CVE-2026-80358

Physical Access Unauthorized Exploit via Improper Access Control on Dell BOSS SMCU

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Boot Optimized Server Storage (boss)
CVE-2026-70413

Hard‑coded Password Leading to Information Exposure in Dell Live Optics Collector

Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Live Optics Collector
CVE-2026-63374

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Agronholm
Products
Anyio
CVE-2026-4556

macOS Exam4 Local Privilege Escalation via Command Injection

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Extegrity
Products
Exam4
CVE-2026-15953

Path Traversal During Project Archive Import

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Protection And Control Ied Manager (pcm600)