Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,942

CVE-2026-61743

Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Chartbrew
Products
Chartbrew
CVE-2026-49995

Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tautulli
Products
Tautulli
CVE-2026-12470

CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Niteo Wordpress
Products
Cmp – Coming Soon & Maintenance Plugin By Niteothemes Wordpress
CVE-2026-72931

Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-69694

Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability

Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS 2.8% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more
CVE-2026-14646

Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect

Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymous user, if anonymous access is enabled — could receive a response from an internal network address or cloud metadata endpoint as repository content, potentially exposing sensitive information such as cloud IAM credentials.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sonatype
Products
Nexus Repository Manager
CVE-2026-72978

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows Server 2012 and 11 more
CVE-2026-78449

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more
CVE-2026-78463

Remote Desktop Client Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Remote Desktop Remote Desktop Client
CVE-2026-24220

ZeroMQ Unsafe Deserialization in NVIDIA TensorRT-LLM Visual Generation Server

NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Tensorrt-llm
CVE-2026-84659

Privilege Escalation via Disabled Sandbox in Jenkins Script Security Plugin

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stapler data binding.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Script Security Jenkins Script Security Plugin
CVE-2026-94425

Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management

A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub_140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Moore Threads
Products
Mtt S80 Driver Package
CVE-2026-93655

Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdevelop
Products
Wordpress Booking Calendar
CVE-2026-75791

Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

CVSS 3.1 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Adselfservice Plus