Search vulnerabilities

Expected end of text, found 'books' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,894

CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

CVSS 3.1 · 9.1 Critical EPSS 6.9% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2026-39832

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Golang
Products
Crypto Ssh
CVE-2026-33814

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net/http Go Http2
CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Net Go
CVE-2026-27137

Incorrect enforcement of email constraints in crypto/x509

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Go Standard Library Golang
Products
Crypto Tls Go
CVE-2026-9796

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Keycloak
CVE-2025-10012

Portabilis i-Educar educar_historico_escolar_lst.php sql injection

A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_lst.php. Such manipulation of the argument ref_cod_aluno leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 is sufficient to resolve this issue. It is advisable to upgrade the affected component. The vendor confirms, that "[t]he reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced".

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Portabilis
Products
I-educar
CVE-2026-57124

PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonai
CVE-2026-9323

Insecure PRNG and Information Exposure in urwid Web Display Backend

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reconstruct the internal state and predict all past and future session IDs (Path B). The same identifier is also used as the filename of a FIFO created in the world-listable /tmp directory (for example /tmp/urwid375487765176907690.in), so any local user on the host can list /tmp to enumerate active session tokens directly (Path A). With a valid session ID, an attacker can read the victim's terminal screen via the polling endpoint, inject keystrokes into the victim's session (yielding OS-level code execution with the session owner's privileges if the session runs a shell), and inject exit sequences or flood the FIFO to terminate or crash the session. A prior Bandit S311 warning on this usage was suppressed with # noqa: S311 rather than fixed

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Urwid
Products
Urwid
CVE-2026-57129

PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonaiagents
CVE-2026-59569

Android ZCC VPN API method privilege escalation

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Zscaler
Products
Client Connector
CVE-2026-4103

Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Wso2 Api Control Plane and 1 more
CVE-2026-82209

domain-scoped PSL domain cookie

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-82208

wolfSSL CA-cache hit overrides callback

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-80255

secure cookie attribute bypass with tab

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-80231

native CA store conn reuse

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird
CVE-2026-80230

OpenSSL pinning bypass

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird