Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,798

CVE-2026-103320

IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Liberty
CVE-2025-0166

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watsonx Orchestrate Cartridge For Cloud Pak For Data
CVE-2026-71199

krb5: Alteration of authentication indicators in CAMMAC container

In MIT krb5 release 1.14 and later (since authentication indicator support was added), an authenticated attacker can bypass authentication indicator requirements using an unkeyed checksum in the CAMMAC authdata container.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-71200

krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request

If a KDC is configured to allow PKINIT authentication, an unauthenticated attacker can trigger a null pointer dereference, causing the process to terminate.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-107884

krb5: Unauthorized key reset of protected principal via kpasswd

In MIT krb5 release 1.15 and later, a client with kadmin administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol.

CVSS 3.1 · 6.7 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-111423

krb5: Improper authorization via flawed PAC checksum verification

In MIT krb5 release 1.21 and later, server applications will erroneously treat the PAC within a ticket as verified when the server checksum is invalid.

CVSS 3.1 · 4.2 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-118380

krb5: kadmind: request alteration and protected information disclosure

In MIT krb5 release 1.4 and later, an active network attacker can alter the arguments sent by a legitimate client to RPC services protected by RPCSEC_GSS, or cause return values to be sent in plain text.

CVSS 3.1 · 7.4 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-119743

pdfmake < 0.3.14 Shared Cache Access Policy Bypass

pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bpampuch
Products
Pdfmake
CVE-2026-124850

SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade. - Requires prior write access to the database to plant a malicious identifier value - Triggered automatically during a migration or upgrade operation - Can result in unauthorized data disclosure, modification, or deletion Affected versions: flowintel prior to 4.0.0

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Flowintel
Products
Flowintel
CVE-2026-123614

imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow

imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evilmartians Imgproxy
Products
Imgproxy Imgproxy
CVE-2026-123566

Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123562

Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123558

Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123554

Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check

Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123550

OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123546

OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail

OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123542

OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow

OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123538

OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation

OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123534

Tornado before 6.6 Path Traversal via static_url() Version Hashing

Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-123526

Vikunja before 2.7.1 Mass Assignment via Team external_id Field

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja