Search vulnerabilities

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,852

CVE-2026-88035

Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C Driver
CVE-2026-88034

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
C++ Driver C\+\+ Driver
CVE-2026-88033

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Java Driver
CVE-2026-81910

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Concretecms
Products
Concrete Cms
CVE-2026-69862

Windows Wireless Wide Area Network Service Information Disclosure Vulnerability

Out-of-bounds read in Windows Wireless Wide Area Network Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 15 more
CVE-2026-69859

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-91750

WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tencent
Products
Weknora
CVE-2026-90945

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Crawlab-team
Products
Crawlab
CVE-2026-90876

SourceCodester Online Faculty Clearance System delete_requirement.php sql injection

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Online Faculty Clearance System