Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,825

CVE-2026-92778

CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yahoo
Products
Cmak
CVE-2026-92779

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Builderio
Products
Sdk-angular Sdk-qwik Sdk-react and 4 more
CVE-2026-92780

KnowStreaming through 3.4.1 Missing Authorization on the REST API

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without proper authorization.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Didi Knowstreaming Project
Products
Knowstreaming Knowstreaming
CVE-2026-92784

@refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Refinedev
Products
@refinedev/inferencer
CVE-2026-92785

Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Angel-ml
Products
Angel
CVE-2026-92790

Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Higress-group
Products
Higress
CVE-2026-50604

Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Agent Service
CVE-2026-50606

Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50607

WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50608

Authentication Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50609

Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50610

Improper Access control Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-90823

Unauthenticated Stack-Based Buffer Overflow in FatPipe Management Interface Allows Remote Code Execution

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fatpipe Networks
Products
Ipvpn Mpvpn Warp
CVE-2026-92918

admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cjbi
Products
Admin3
CVE-2026-92919

admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Cjbi
Products
Admin3
CVE-2026-92920

admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cjbi
Products
Admin3
CVE-2026-92932

MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0. Because PHP's && operator has higher precedence than ||, the expression is evaluated as ($options['readFile'] && strpos($input, 'http://') === 0) || strpos($input, 'https://') === 0. As a result, when a caller explicitly sets the readFile option to false to disable file and URL reading, an input string beginning with https:// still satisfies the condition and triggers a network fetch via HttpSocket (configured to follow up to 10 redirects). The http:// branch is correctly gated by the readFile flag, but the https:// branch is not. An attacker who can influence the $input parameter passed to Xml::build() can therefore force the application to issue an outbound HTTPS request to an attacker-controlled or internal URL, even though the caller intended to suppress all remote reads. The fetched response is parsed as XML and may be returned to the caller, enabling information disclosure from internal services or external targets. This constitutes a Server-Side Request Forgery (SSRF) weakness with an information-disclosure impact. The vulnerability requires that the code path in Xml::build() be reachable with attacker-controlled input and that the readFile option be set to false (or the caller expects it to be false).

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Misp
Products
Sachertortephp
CVE-2026-89418

Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested START_GROUP wire bytes to any Node.js service that calls the generated deserializeBinary() API, causing a RangeError: Maximum call stack size exceeded and crashing the process. No authentication or prior knowledge of the schema is required.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Google
Products
Protobuf-javascript
CVE-2026-71568

BMCtest exposes Ironic without authentication and TLS during the test

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openshift-metal3
Products
Bmctest