Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,103

CVE-2026-125745

WCK before 2.4.1 Missing Authorization via wck_show_update_form AJAX

Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125672

Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-125404

Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption

Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ettercap Ettercap-project
Products
Ettercap Ettercap
CVE-2026-125400

Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution

Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ettercap Ettercap-project
Products
Ettercap Ettercap
CVE-2026-125392

Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View

Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webmin
Products
Webmin
CVE-2026-125388

Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Intermesh
Products
Group-office
CVE-2026-125384

INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Go2ismail
Products
Asp.net-core-inventory-order-management-system
CVE-2026-125380

DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test

DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT SQL to query any configured relational data source using its stored decrypted credentials, bypassing developer-only restrictions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gcpaas
Products
Dataroom
CVE-2026-125376

VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mereithhh
Products
Vanblog
CVE-2026-125372

REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Getrebuild
Products
Rebuild
CVE-2026-125368

OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Yeqing17-2026
Products
Omniagent
CVE-2026-125364

frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersController

frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by submitting unchecked nested conference_users_attributes. Attackers can abuse UsersController#update or #create, which skip filter_conference_users, to gain orga on any conference and fully manage its events, schedule, reviewers and crew.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Frab
Products
Frab
CVE-2026-125360

Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Southclaws
Products
Storyden
CVE-2026-125117

Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting dotted paths in $__set, and merging update documents in utils.mergeClone. Attacker-controlled keys such as toString or valueOf can therefore cause Mongoose to write into shared built-in functions instead of an own property. A crafted document, Mixed path, non-strict document or subdocument, findOneAndReplace() replacement, chained update, or Query.prototype.merge() source can overwrite Object.prototype.toString.call, causing later queries on unrelated models to fail until the process restarts. Separately, when an attacker controls the dotted path passed to doc.set(path, value) for a subdocument configured with strict: false, descent through $__set can reach $__schema and alter shared validators or schema options for later documents. Mongoose already blocks __proto__, constructor, and prototype, so this issue overwrites properties on reachable shared objects rather than adding new properties directly to Object.prototype. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Mongoose
CVE-2026-125113

XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern

The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when two dots are followed by a slash and does not reject a terminal two-dot component. An unauthenticated attacker can append /.. to an exported path in xrdfs ls or an HTTP PROPFIND request, bypass the all.export directory scope, and cause directory and filename enumeration in the parent directory under oss.localroot. The demonstrated vector does not permit file download or disclose file contents. This issue is fixed in version 5.9.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Xrootd
Products
Xrootd
CVE-2026-125109

Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Rack
Products
Rack
CVE-2026-125107

Muhammara: NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms dictionary that omits the EarlyChange key. An application that processes an untrusted PDF and reads the affected stream can crash, causing a denial of service. This issue is fixed in version 6.0.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Julianhille
Products
Muhammarajs
CVE-2026-125079

D-Link DCS-6501LH Media Service SystemConfig.ini mydlink_default_sys_info hard-coded credentials

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. This impacts the function pf_get_onvif_user_pwd/mydlink_default_sys_info of the file /mnt/conf/SystemConfig.ini of the component Media Service. This manipulation of the argument pin_code causes hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dcs-6501lh
CVE-2026-125075

SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication

A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Smart Attendance System With Qr Code Scanner
CVE-2026-124994

Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds

A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Turboderp-org
Products
Exllamav3