Search vulnerabilities

Expected end of text, found ':' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-86211

rabindralamsal inventory-management-system Login index.php sql injection

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rabindralamsal
Products
Inventory-management-system
CVE-2026-86193

Grav API Plugin Authentication Bypass via Group-Inherited Super

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav Grav-plugin-api
CVE-2026-86182

diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Diem-project
Products
Diem
CVE-2026-86171

DefaultFuction CRM delete.php sql injection

A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Defaultfuction
Products
Crm
CVE-2026-86165

Tenda HG10 formURL buffer overflow

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed
Vendors
Tenda
Products
Hg10 Hg10 Firmware
CVE-2026-86160

SourceCodester Online Voting System ajax.php delete_voting sql injection

A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Online Voting System
CVE-2026-86150

Tenda CP3 hostapd hard-coded credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Cp3 Cp3 Firmware
CVE-2026-86144

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86139

libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Xmlsoft
Products
Libxml2
CVE-2026-86118

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sentriz
Products
Gonic
CVE-2026-86113

BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and progress mode, affecting reading statistics and exported data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bookwyrm-social Joinbookwyrm
Products
Bookwyrm Bookwyrm
CVE-2026-86097

PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Px4
Products
Autopilot
CVE-2026-79697

Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This affects the function basicstation_apply of the component Basic Station Certificate-Deletion Handler. This manipulation of the argument act causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.4_20260821 is able to mitigate this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 9.4 Critical EPSS 4.9% KEV · Not listed
Vendors
Advantech
Products
Wise-6610 Wise-6610-cb Wise-6610-eb and 11 more
CVE-2026-77263

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Iubenda Wordpress
Products
Iubenda | All-in-one Compliance For Gdpr / Ccpa Cookie Consent + More Wordpress
CVE-2026-52774

Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-52769

YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL validation. An unauthenticated remote attacker can therefore make YesWiki issue arbitrary outbound HTTP requests to any host the server can reach - internal services, cloud-metadata endpoints (169.254.169.254), intranet-only admin panels, etc. - and read enough back via timing and error-message oracles to scan ports, enumerate services, and (on a real cloud instance) reach IAM metadata. The only deployment-side precondition is that ActivityPub be enabled on at least one Bazar form. This issue has been patched in version 4.6.6.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-4945

Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Otter Blocks – Gutenberg Blocks, Page Builder For Gutenberg Editor & Fse Wordpress
CVE-2026-48019

CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Laravel
Products
Framework
CVE-2025-15647

CDT before 1.4.5 Out-of-Bounds Read via opposedVertexInd

CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges through geometry data to trigger an out-of-bounds array access that crashes the calling process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Artem-ogre
Products
Cdt
CVE-2022-51015

PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negative or out-of-range) to crash the server, resulting in a denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Pmmp
Products
Pocketmine-mp