Search vulnerabilities

Expected end of text, found ':' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-62650

Server‑Side Authorization Bypass in Reyrolle 7SR5 Web Interface Enabling Privilege Escalation

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Reyrolle 7sr5
CVE-2026-62654

Reyrolle 7SR5 Physical Access Code Execution via Maintenance Mode

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Reyrolle 7sr5
CVE-2026-86550

UXSS vulnerability in ZTE browser products

NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting (UXSS) vulnerability that enables script execution within the origin of arbitrary websites.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Nebulaos
CVE-2026-9331

EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pixelyoursite Wordpress
Products
Edd Product Catalog Feed By Pixelyoursite Wordpress
CVE-2026-19614

XML External Entity (XXE) Injection in CyberELF NanoXML

The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cyberelf
Products
Nanoxml
CVE-2026-77968

Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Build Of Apache Camel - Hawtio
CVE-2026-78234

Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Hawtio Build Of Apache Camel - Hawtio
CVE-2026-75021

fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Fastify-cli
Products
Fastify-cli
CVE-2026-72835

filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Filebrowser
Products
Filebrowser
CVE-2026-69764

Microsoft Office Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office 2016 Office 2019 and 4 more
CVE-2026-14444

WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new user account with administrator privileges and gain full control over the WordPress site. The required access_key is intentionally shared with ThriveCart customers as part of the plugin's documented setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Verygoodplugins Wordpress
Products
Wp Fusion Wordpress
CVE-2026-66767

Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sap Netweaver Application Server Abap And Abap Platform
CVE-2026-76967

Insecure Deserialization in SAP NetWeaver Business Client

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Business Client
CVE-2026-76971

Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Manufacturing Integration And Intelligence
CVE-2026-81802

WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Magepeopleteam Wordpress
Products
Wpevently Wordpress
CVE-2026-50093

Arbitrary File Upload Vulnerability in Siemens Siveillance Control Leading to Root Access

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Siveillance Control Siveillance Control Pro
CVE-2026-33197

BDS Module Bypass Secure Boot Advisory

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ami
Products
Aptio V
CVE-2026-0001

Mali GPU Kernel Driver allows access to already freed memory

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory. This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arm
Products
Arm 5th Gen Gpu Architecture Kernel Driver Bifrost Gpu Kernel Driver Valhall Gpu Kernel Driver