Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,959

CVE-2026-78310

Authorization Bypass Through User-Controlled Key in DIAEnergie

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2026-78312

Path Traversal in DIAEnergie

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2026-55294

Android Local Privilege Escalation via Heap Buffer Overflow in ihevcd_utils

In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-55290

Out‑of‑Bounds Heap Read in Android ResourceTypes.cpp Allows Local Information Disclosure

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Android
CVE-2026-69398

Windows Bluetooth Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1809 Windows 10 21h2 Windows 10 21h2 and 15 more
CVE-2026-69408

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-70570

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-69827

Windows DNS Server Remote Code Execution Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more
CVE-2026-97321

YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yunaiv Zhijiantianya
Products
Ruoyi-vue-pro Ruoyi-vue-pro
CVE-2026-80143

Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as any user to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Lantronix
Products
Emg7500 Emg8500 Slb882 and 3 more
CVE-2026-75743

Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed
Vendors
Adobe
Products
Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee