Search vulnerabilities

Expected end of text, found '/' (at char 42), (line:1, col:43)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2026-66795

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Multicluster Engine
CVE-2026-77218

PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential Handlers

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the enbPass POST parameter into a fixed-size stack buffer without length validation, and the web_sys_localUser_post handler copies the usrName and usrPass POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, resulting in denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-77217

PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75126

PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard Handlers

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: web_vlan_membership_edit_dialog_post; web_dai_vlan_post; web_poe_alive_rmtip_post; web_sys_sntp_post; web_tool_upgradeManager_post; web_port_countersClr_post; web_rmon_statisticsClr_post; web_cablediag_copper_post; web_aaa_*Authlist* handlers; web_acl_mgmt_Rules_Apply_post; web_acl_mgmt_Rules_Edit_post; web_acl_*AceDel_post handlers; web_acl_*AceAdd/Edit_post handlers; web_acl_bindAdd_post; web_acl_bindEdit_post; web_snmp_v3view_add_post; web_snmp_v3group_add_post; web_snmp_v3community_add_post; web_snmp_v3host_add_post; web_snmp_notifyv3_add_post; web_snmp_v3user_add_post; web_snmpv3_remote_engineId_add_post; web_stp_globalSetting_post; web_isg_db_post; web_tacplus*_post handlers; web_dhcp_option82_post; and web_dhcp_port_option82_cid_post. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75125

PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the rmtIP parameter to cause the CGI process to dereference a null pointer and crash, resulting in denial of service of the web management interface.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75124

PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75123

PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device.

CVSS 4.0 · 8.6 High EPSS 1.5% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75122

PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-75121

PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post

PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the device.

CVSS 4.0 · 8.6 High EPSS 1.5% KEV · Not listed
Vendors
Planet Technology Corp
Products
Planet Gs-4210-16p2s
CVE-2026-59850

Libssh: libssh: use-after-free via data callbacks on closed channels

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2026-59848

Libssh: libssh: denial of service via sftp responses with unknown request ids

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2026-59846

Libssh: libssh: information disclosure via proxycommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2026-59845

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2026-59844

Libssh: libssh: denial of service via oversized sftp read length

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2026-59843

Libssh: libssh: denial of service via zero advertised channel packet size

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Hardened Images and 1 more
CVE-2025-71407

rubygem-nokogiri: Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed
Vendors
Nokogiri
Products
Nokogiri
CVE-2025-71406

nokogiri: libxslt: Nokogiri: Memory corruption via crafted XSLT

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Nokogiri
Products
Nokogiri
CVE-2025-71346

nokogiri: libxml2: Nokogiri: Heap buffer under-read in XML Schema validation

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 2.9 Low EPSS n/a KEV · Not listed
Vendors
Sparklemotion
Products
Nokogiri
CVE-2024-58377

rubygem-nokogiri: Nokogiri before 1.16.5 libxml2 Dependency Update

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Nokogiri
Products
Nokogiri