Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,897

CVE-2026-18672

RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Ajax
CVE-2026-19219

DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Ajax
CVE-2026-84803

SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-18765

SQL Injection in Teracity Sotware's Teracity E-OSB Platform

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Teracity
Products
E-osb
CVE-2026-84149

Information Disclosure Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Manacle Technologies
Products
Multi-tenant Erp System
CVE-2026-18808

Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO

Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection. This issue affects KIO (Klemsan Internet Objects): before v1.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Klemsan Electrical Electronics
Products
Kio (klemsan Internet Objects)
CVE-2026-18210

SQL Injection in TRtek Technological Products's Store

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Trtek
Products
Products Store
CVE-2026-18771

Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tmt Machine
Products
Talassoft Industrial Management Software
CVE-2026-18780

CSRF in TMT Machine's Talassoft Industrial Management Software

Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tmt Machine
Products
Talassoft Industrial Management Software
CVE-2026-18630

SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Tmt Machine
Products
Talassoft Industrial Management Software
CVE-2026-18931

Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Tmt Machine
Products
Talassoft Industrial Management Software
CVE-2026-10195

FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Fs-code Wordpress
Products
Fs Poster - Wordpress Social Media Auto Poster & Scheduler [facebook, Instagram, Twitter, Pinterest] Wordpress
CVE-2026-8712

Wyoming < 1.10.2 SSRF via uri Query Parameter

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ohf-voice
Products
Wyoming
CVE-2026-73700

Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73701

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73702

Authenticated Privilege Escalation Vulnerability in the API of HPE Networking Fabric Composer

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-45221

Konga < 2.1.0 Privilege Escalation via Hardcoded OpenSSL Path

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing directory resides in a location writable by any authenticated local user, enabling attackers to create the directory and place malicious files that execute at the privilege level of the user or service account that launches Konga, facilitating privilege escalation.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Easybyte Software
Products
Konga
CVE-2026-73745

Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer

A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access when combined with other vulnerabilities.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer
CVE-2026-73703

Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Fabric Composer Fabric Composer