Search vulnerabilities

Expected end of text, found 'books' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,898

CVE-2026-90787

Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Soarkey
Products
Studentmanagement
CVE-2026-91079

Huly Platform through 0.7.426 SSRF via Print Service

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-91021

CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary JavaScript that executes for any user who opens the shared note, including administrators.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-90813

cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cosmicstack-labs
Products
Mercury-agent
CVE-2026-86714

PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-86543

knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Knowns-dev
Products
Knowns
CVE-2026-86538

knowns before 0.30.0 Path Traversal via templateFile parameter

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Knowns-dev
Products
Knowns
CVE-2026-86114

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts that execute with administrative privileges when deployed by administrators.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Getarcane
Products
Arcane
CVE-2026-86098

ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Ntop
Products
Ndpi
CVE-2026-86090

ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ntop
Products
Ntopng
CVE-2026-85892

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Chromium
CVE-2026-85698

Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-count field without bounds validation. Attackers can craft a malicious database file with a modified cell count value to trigger an index-out-of-bounds panic when querying, causing denial of service in any application that opens untrusted database files.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tursodatabase
Products
Turso
CVE-2026-85693

Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mckaywrigley
Products
Chatbot-ui
CVE-2026-85688

TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system paths, enabling code execution through authorized_keys, cron files, or executable graph files.

CVSS 4.0 · 9.3 Critical EPSS 2.6% KEV · Not listed
Vendors
Ten-framework
Products
Ten-framework
CVE-2026-85676

Dub Open Redirect via Unrestricted redir_url Parameter

Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dub
Products
Dub
CVE-2026-85671

QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclose cross-tenant knowledge base content.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netease Youdao
Products
Qanything Qanything
CVE-2026-85666

ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along with headers and authorization values) that is fetched server-side without destination validation; the existing validate_url_not_private() guard used for other URL inputs is not applied to server_url. On the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to open connections to arbitrary internal addresses (including cloud metadata endpoints such as http://169.254.169.254/) and forward attacker-supplied headers and bearer tokens to those destinations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ogx-ai
Products
Ogx
CVE-2026-85661

excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Haris-musa
Products
Excel-mcp-server
CVE-2026-85625

sift 17.1.3 Prototype Pollution Remote Code Execution via $where

sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is set (not set by default). As a result, if a prototype-pollution primitive elsewhere in the process sets Object.prototype.$where to a malicious string, even benign filter calls such as sift({}) execute arbitrary JavaScript. Additionally, passing an untrusted query object containing a string $where directly to sift results in code execution under the default configuration.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Crcn
Products
Sift.js
CVE-2026-85620

Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Crystaldba
Products
Postgres-mcp