Search vulnerabilities

Expected end of text, found ':' (at char 21), (line:1, col:22)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,468

CVE-2026-17336

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17319

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17311

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17066

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17049

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-12067

AvastSvc denial of service via unhandled JsonCpp exceptions in native message handlers

Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages. The vulnerability spans multiple handler pathways in the RPC-based native message protocol: * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries.  * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception. * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation. In all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126050

apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()

apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk length exceeds the fixed buffer size, corrupting heap memory when users dump, inspect, or replay it.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125756

postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation

postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125752

Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus

Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125748

Parabol before 15.21.2 Missing Authorization via addReactjiToReactable Mutation

Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mutation that allows authenticated users to tamper with reactions on other organizations' content. Attackers can pair their own meetingId with a reactableId of another tenant's reflection, comment, or sequential team prompt response to add or remove their reactions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125709

Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hummingbird Openshift and 1 more
CVE-2026-125403

Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts

Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Ettercap-project
Products
Ettercap
CVE-2026-125399

Fluxion before 6.39 OS Command Injection via Crafted SSID

Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID to execute commands as root when the operator scans or selects it.

CVSS 4.0 · 8.6 High EPSS 1.3% KEV · Not listed
Vendors
Fluxionnetwork
Products
Fluxion
CVE-2026-125395

Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ampache
Products
Ampache
CVE-2026-125391

Webmin through 2.670 OS Command Injection via Samba User Account Options

Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root.

CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed
Vendors
Webmin
Products
Webmin
CVE-2026-125387

Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController

Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/assign and ticket/surrender endpoints to close, merge or reassign other departments' tickets and enumerate customers' ticket subjects.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Faveosuite Ladybirdweb
Products
Faveo-helpdesk Faveo Helpdesk
CVE-2026-125379

Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read

Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Movim
Products
Movim
CVE-2026-125375

MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers

MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mrdoc
Products
Mrdoc
CVE-2026-125363

MikroDash before 0.8.79 SSRF via Personal Notification Channels

MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN or link-local addresses and call POST /api/notify-channels/{id}/test to probe the internal network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Secops-7
Products
Mikrodash
CVE-2026-125359

Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting

Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou() to send server-side POST requests to internal hosts and use distinct error responses as an oracle for internal host and port discovery.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fancydirty
Products
Mediary-scout