Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,807

CVE-2026-123815

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Pyload
Products
Pyload
CVE-2026-9764

IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Bob Bob Shell
CVE-2026-75879

Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator

IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Content Navigator
CVE-2026-3684

Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Data System
CVE-2026-18893

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cockroachdb Postgresql For Ibm Vpc
CVE-2026-12735

IBM Controller Disclosure Management has addressed vulnerabilities

IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Controller Disclosure Management
CVE-2026-125221

FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion that crashes the process during demuxing or parsing.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125220

FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure

FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame followed by inter frames to hang frame-threaded decoding indefinitely.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125215

FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()

FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerability in ff_dovi_rpu_generate() in libavcodec/dovi_rpuenc.c that allows attackers to crash applications via crafted Dolby Vision RPU metadata. Attackers can supply streams with default or alternating omitted DM blocks to the dovi_rpu bitstream filter with compression enabled, causing denial of service.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125072

FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing reads through a NULL buffer that crash the process.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-125066

FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads from a NULL buffer and crashing the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ffmpeg
Products
Ffmpeg
CVE-2026-107330

DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Datastage On Cloud Pak For Data
CVE-2026-123818

LMDeploy URL parser disagreement permits SSRF filter bypass

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Internlm
Products
Lmdeploy
CVE-2026-123819

Wagtail: Improper permission handling when copying snippets

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wagtail
Products
Wagtail
CVE-2026-124999

braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversal

A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Braindecode
Products
Braindecode
CVE-2026-123805

SIPSorcery: Unbounded SCTP SACK gap/duplicate counts cause out-of-bounds read that kills the data-channel receive thread (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated WebRTC peer can send a checksum-valid malformed SACK chunk that drives the parser beyond the 262144-byte receive buffer. The resulting IndexOutOfRangeException bypasses the recoverable ApplicationException handler in RTCSctpTransport.DoReceive, causing the generic handler to exit the dedicated receive loop and permanently terminate the SCTP association and all data channels. This issue is fixed in 10.0.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sipsorcery-org
Products
Sipsorcery
CVE-2026-84410

apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing

In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and executes ldd on the attacker-controlled ExecutablePath field of a crash file placed in the world-writable /var/crash directory, causing the dynamic loader to load and execute an attacker-supplied audit module specified by the ELF's DT_AUDIT tag. This allows an attacker to execute arbitrary code with root privileges and fully compromise the affected system.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Apport
CVE-2026-124996

Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds

A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Turboderp-org
Products
Exllamav3
CVE-2026-124033

Relative path traversal in the log export commands in AWS ParallelCluster CLI

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command. To remediate this issue, users should upgrade to version 3.16.0 or later.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-parallelcluster
CVE-2026-8860

IBM Verify Directory is affected by multiple vulnerabilities

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Directory Verify Directory